Questions tagged [attacks]
attempts by malicious users or software to subvert/manipulate the behaviour of an application or network
2
votes
1answer
23 views
Would a 51% attack be easier if an attacker can DoS certain nodes?
I am wondering whether a 51% attack would be simplified by being able to remotely crash miner nodes. Consider the following scenario:
Malicious mining pool A controls 16% percent of the mining power ...
3
votes
1answer
35 views
Understand the trending of newly-uploaded smart contracts that is considered as vulnerable
We tried to use Oyente to analyze some online contracts and drawed a diagram regarding the potentially vulnerable smart contracts ("reentrancy" bug) with respect to their creation time.
So the y-...
0
votes
2answers
41 views
Create two contracts that each with different accounts.
I'm a newbie in blockchain. I am trying to repeat DAO attack using two different contracts, in my case DAO and Hacker. I want the 2 contracts belongs to 2 separated account, so I can see that the ...
0
votes
1answer
41 views
What is the work of self destruct in a contract?
How it can be used for handling force sending of ether to a contract without triggering fallback function ?
0
votes
0answers
47 views
A couple of questions on the Short Address attack
I have a few questions on the Short Address attack:
Is it possible to apply this attack on a function which does not take encoded byte-code as input and execute it, for example - function func(bytes ...
2
votes
1answer
68 views
Did DAO attacker gained ETH on Ethereum Classic?
I'm starting to study blockchain's world and the DAO attack caught my attention.
I studied how it worked and the solution proposed by the Ethereum community.
The hard fork splitted the blockchain in ...
3
votes
0answers
103 views
Denial attacks by submitting transactions with strategically calculated gas prices
As can be understood from the title, there is a specific form of denial attack where specific transactions are blocked by submitting transactions with strategically calculated gas prices.
Example 1: ...
1
vote
1answer
288 views
How does the exploit in FOMO3D work?
With the recent release of the FOMO3D exploit in its smart contract, how does the exploit work?
1
vote
1answer
30 views
Account management risks of booting into Tails OS from USB using a “partially air-gapped” Linux PC
My threat tolerance is around a 3 out of 5 on the paranoia scale. What are the practical account management risks of using a flash drive loaded with Tails OS to boot into a Linux PC, which will only ...
2
votes
3answers
120 views
Are Ethereum Contracts Vulnerable to Hash Table Poisoning Attacks?
Does anybody know something about this? I know that in general terms we will say not, but looking on the internet I found that isn't sure the answer to the question:
Can the EVM’s Internal ...
1
vote
1answer
35 views
Is it possible to use low mining complexity to remove some certain transaction in the past?
I have a question that has concerned me for a long time. It relates to the security and reliability of the blockchain applications.
Let's assume I want to build an application that uses Ethereum or ...
4
votes
1answer
151 views
ERC20 transfer - caller expects return but none provided - what happens?
If someone implements the ERC20 transfer() function without the return value as follows:
function transfer(address to, uint256 value) public {
require( ... usual checks ... );
balances_[msg....
2
votes
0answers
124 views
Who created this alt-Ropsten blockchain and why?
I usually test on Rinkeby, but this week I have to test some mining stuff, so I tried to get synced up with Ropsten. Unfortunately, after 3 days of trying, I still haven't had any success. The main ...
1
vote
1answer
279 views
Best practices for a secure Ethereum private network? [closed]
What are the best practices for an Ethereum private network with n nodes (programmed with Geth), to be secure from possibles external attacks?
I mean, which config parameters are recommended during ...
1
vote
1answer
217 views
What is the Eclipse attack and how was it fixed in Ethereum?
In this paper the researchers describe the Eclipse attack https://eprint.iacr.org/2015/263.pdf. Can someone explain it briefly, what steps an attacker needs to take to perform the attack and how it ...
6
votes
2answers
708 views
How does the 'secret chain' catch up with the real chain in the long range attack?
I'm trying to dig deep into Casper and one of the things that keep coming up is the long-range attack in PoS. I understand the attack at a high level - basically you would go back some large amount of ...
4
votes
1answer
821 views
Dealing with the short address attack
I'm writing a contract for an ERC20 token, based on Zepellin contracts. I noticed that their code doesn't handle the short address attack. Does it mean I shouldn't care about it?
1
vote
0answers
19 views
Why an attacker needs ~2^128 computing power to spoof membership of a key/value pair in a trie?
Ethereum Wiki:
Every unique set of key/value pairs maps uniquely to a root hash, and
it is not possible to spoof membership of a key/value pair in a trie
(unless an attacker has ~2^128 ...
0
votes
1answer
30 views
Leverage short positions in decentralised PoW currencies
Hint
I asked this question in a similar style already on bitcointalk and on bitcoin.stackexchange. But in these threads, there are no good answers and I thought maybe it would be better to ask the ...
1
vote
1answer
164 views
Unable to replicate short-address attack
I was reading about the short address attack and decided to replicate and test the possible solutions.
What I know about short address attack is if you skip n characters of your address, you end up ...
0
votes
1answer
338 views
What are the most common attack patterns on a Smart Contract? [duplicate]
i'm new to Solidity.
After writing my first smart contract im fairly concerned about it's security, once deployed to the MainNet. What are the most important things i should check within my code? ...
6
votes
2answers
487 views
Is sending some datas in the data field safe?
An airdrop ask to send it 0ETH with 150000 GAS and some datas in DATA field.
Is it safe?
What could be the aim of this transaction?
Thanks.
5
votes
1answer
104 views
Plasma.io: What if someone is offline during a mass withdrawal?
I'm reading the Plasma paper published a couple months ago, and on page 27, they talk about "Adversarial Mass Withdrawals" in the event of block withholding.
My question is, what if someone is ...
3
votes
1answer
1k views
Is it Safe to Share the Wallet Keystore File Without Password?
There is an ICO that asks for ethereum keystore file, which is unusual for me as far as ICOs go. Even though it does not looks like it contains private key and password it still feels unsettling.
Is ...
2
votes
3answers
400 views
In ethereum, what happen if someone controls a large majority of mining power?
If someone manages more than 50% of the mining power, this situation necessarily compromises the integrity of the past blocks and newly generating blocks?
1
vote
2answers
357 views
What if a malicious party sends two transactions with same nonce?
It's said nonce is used to prevent reply/double-spending attack. But an adversary can send two transactions with the same nonce, and the rest of scenario will be the same as in Bitcoin.
Question 1: ...
4
votes
1answer
109 views
Can an Ethereum key generated on a laptop be brute-forced by someone else because of low entropy?
I read this and this tweets. Though, I understand that this issue occur because some people use the same private key mentioned in a blog/forum.
But, on the first tweet, people were talking about the ...
3
votes
0answers
202 views
Did f2pool manipulate transactions during the Status ICO?
Blocks such as this one and this one appear to show preferential treatment being given to f2pool transactions in blocks mined by f2pool during the beginning of the Status ICO (at block height 3903900)....
1
vote
0answers
88 views
Account/Contract address of people responsible for Ethereum Attacks?
I believe there has been a hard fork following the DAO attack; I guess it's not possible to get the contract/account address for the person responsible, unless I am wrong and there is a way, please ...
2
votes
1answer
181 views
What is a “51% spawn camp attack”, and is it any different from a normal 51% attack
What is a "51% spawn camp attack", and is it any different from a normal 51% attack. Saw this mentioned in this tweet from Vitalik.
Is there a distinction that I am missing?
1
vote
1answer
180 views
DAPP vs Consensus attacks
Are contracts such as DAPPs on the Ethereum block chain vulnerable to consensus attacks like Bitcoin is, such as say, to Gambler's ruin?
34
votes
5answers
7k views
Ropsten testnet is under kind of attack? What can we do?
For the last approximately 24 hours, Ropsten testnet is under an attack in my opinion. The gas limit is raised to 200m and the attacker was proposing blocks with more than 4,000 internal txs ...
5
votes
1answer
649 views
During which blocks did the DDos attack create millions of empty accounts?
This post (Why were empty accounts allowed to be on the blockchain?) discusses the Ddos attack from fall 2016. It mentions that nearly 20,000,000 account were created and then immediately deleted ...
10
votes
1answer
251 views
How was the state-bloat attack that led to the EIP 150 hardfork performed?
I understand that SELFDESTRUCT and mispricing of opcodes allowed many empty accounts to be created cheaply as explained in Why were empty accounts allowed to be on the blockchain? The answer to that ...
1
vote
0answers
128 views
Are there any real examples of Sybil attack? [closed]
I have seen many articles and blog posts talking about Sybil attack but except the case of Tor (Article Link), i couldn't find any relevant articles pointing to the Sybil attack on Computer Networks ...
3
votes
1answer
55 views
How to count empty accounts?
Is there a way to count empty accounts using geth ? I just want to be able to track current DDOS cleanup process.
2
votes
0answers
73 views
What is an empty account if the state root is not empty?
"State-bloat" attacks led to an empty account being defined as an account that has zero balance, nonce and code.
There was a disagreement on EIP 161:
I disagree. An account should be considered ...
15
votes
1answer
637 views
Why were empty accounts allowed to be on the blockchain?
It's hard to see what the benefits of allowing empty accounts to be on the blockchain are. This was a known subtlety (see "note: there is a difference between zero-balance and nonexistent") and ...
22
votes
2answers
44k views
Why is my node synchronization stuck/extremely slow at block 2,306,843?
Using macOS 10.12.1 with Ethereum Wallet 0.8.7, nodes are connected but Sync doesn't even start. Stuck at block 2,306,843.
What can I do? Please keep in mind, I am neither a coder nor a tech geek.
3
votes
2answers
286 views
Can a potential bug in the ethereum VM be used to deploy a trojan on every node in the ethereum network?
This has been on the back of my mind for a long time but has resurfaced with the recent dos attacks.
The constructor of a smart contract is executed by all nodes at the time of contract deployment.
...
1
vote
1answer
234 views
Running Wallet 0.8.6 with Parity 1.3.8 [Low # peers, Low speed] [duplicate]
Wondering why my blocks are processing so slowly. Peers ranging from 0 to 10. About 45,000 blocks behind... Processing 1 block about every 5 seconds.
2
votes
1answer
592 views
When will the Baddies have access to the hacked funds on the Ethereum Classic chain?
The Baddies drained 3641694.241898506992612606 ETH via The DAO's child DAO #59.
When will the Baddies have access to the hacked funds on the Ethereum Classic chain?
See also:
Which split proposal ...
2
votes
1answer
176 views
Reproducing recursive call exploit
Here's a contract that I want to attack using recursive call:
contract Abstract {
function foobar();
}
contract B {
uint stateVar;
function foo(Abstract someAddress){
...
3
votes
2answers
249 views
Give some examples of documentation that talks about reentrancy attacks / recursive call vulnerabilities
The DAO, a smart-contract on Ethereum, was vulnerable to reentrancy attacks and 3 million ETH worth $50 million was stolen from it.
What are some examples of content that mentions reentrancy attacks? ...
3
votes
2answers
349 views
Besides TheDAO - what are some examples of where Ether has been hacked, stolen or lost?
Besides TheDAO - what are some examples of where Ether has been hacked, stolen or lost ?
-1
votes
1answer
142 views
Why the DAO hacker could single handedly crash the ETC market many times over? [closed]
Disclosure: I started to read about crypto-coins a couple days ago.
I read in this post comments that the DAO hacker, who holds many ETC (non-forked chain), can crash the market for good and end ETC ...
2
votes
0answers
318 views
Can Ethereum be shut down?
How realistic is to shutdown Ethereum network, so the smart contracts won't be executed anymore?
Are there any practical or theoretical destructive ways to do it? Intentionally or not?
Like a ...
3
votes
2answers
312 views
Is the DAO hardfork technically a 51% attack?
Can the DAO hardfork be viewed as a (a publicly planned) 51% attack on the network?
Motivation / ethics / justice aside, I'm asking this from a purely technical point of view.
If not, what ...
2
votes
1answer
516 views
What's happening within child DAO #59 on the ETC chain?
From What are the balances of The DAO and it's child DAOs on the Ethereum Classic chain? we know that the baddies have drained 3641694.241898506992612606 ETH from child DAO #59.
What is happening ...
9
votes
1answer
2k views
What are the balances of The DAO and it's child DAOs on the Ethereum Classic chain?
At the hard-fork block #1,920,000, the ETH balance from The DAO and it's child DAOs (which includes the balance from the extraBalance account) were transferred into the Withdrawal contract.
What are ...
