Ethereum

Questions tagged [attacks]

Ask Question

attempts by malicious users or software to subvert/manipulate the behaviour of an application or network

86 questions
Newest
Active
Bountied
Unanswered
Filter by
Sorted by
Tagged with
3
votes
1answer
28 views

What is the “pre-commit” scheme to defeat TOD attack?

I am writing to inquire feasible strategies to defeat Transaction Ordering Dependence (TOD) bugs. I learned from the best practice guideline such that we can use a so-called "pre-committed" scheme ...
0
votes
1answer
44 views

Griefing Attacks: Are they profitable for the attacker?

The following article explains one of the solutions for indirectly validate a block when cross-sharding transaction between two shards to prevent invalid blocks. The article called one of these ...
1
vote
1answer
29 views

adaptive vs. non-adaptive adversaries? Is there a precise, unique and general definition? (Updated)

In this Ethereum github page (Link to the page: https://github.com/ethereum/wiki/wiki/Sharding-FAQ#what-are-the-security-models-that-we-are-operating-under) there is a very brief definition of the ...
2
votes
1answer
27 views

Would a 51% attack be easier if an attacker can DoS certain nodes?

I am wondering whether a 51% attack would be simplified by being able to remotely crash miner nodes. Consider the following scenario: Malicious mining pool A controls 16% percent of the mining power ...
3
votes
1answer
40 views

Understand the trending of newly-uploaded smart contracts that is considered as vulnerable

We tried to use Oyente to analyze some online contracts and drawed a diagram regarding the potentially vulnerable smart contracts ("reentrancy" bug) with respect to their creation time. So the y-...
0
votes
2answers
54 views

Create two contracts that each with different accounts.

I'm a newbie in blockchain. I am trying to repeat DAO attack using two different contracts, in my case DAO and Hacker. I want the 2 contracts belongs to 2 separated account, so I can see that the ...
0
votes
1answer
54 views

What is the work of self destruct in a contract?

How it can be used for handling force sending of ether to a contract without triggering fallback function ?
0
votes
0answers
57 views

A couple of questions on the Short Address attack

I have a few questions on the Short Address attack: Is it possible to apply this attack on a function which does not take encoded byte-code as input and execute it, for example - function func(bytes ...
3
votes
1answer
83 views

Did DAO attacker gained ETH on Ethereum Classic?

I'm starting to study blockchain's world and the DAO attack caught my attention. I studied how it worked and the solution proposed by the Ethereum community. The hard fork splitted the blockchain in ...
3
votes
0answers
138 views

Denial attacks by submitting transactions with strategically calculated gas prices

As can be understood from the title, there is a specific form of denial attack where specific transactions are blocked by submitting transactions with strategically calculated gas prices. Example 1: ...
1
vote
1answer
297 views

How does the exploit in FOMO3D work?

With the recent release of the FOMO3D exploit in its smart contract, how does the exploit work?
1
vote
1answer
38 views

Account management risks of booting into Tails OS from USB using a “partially air-gapped” Linux PC

My threat tolerance is around a 3 out of 5 on the paranoia scale. What are the practical account management risks of using a flash drive loaded with Tails OS to boot into a Linux PC, which will only ...
2
votes
3answers
131 views

Are Ethereum Contracts Vulnerable to Hash Table Poisoning Attacks?

Does anybody know something about this? I know that in general terms we will say not, but looking on the internet I found that isn't sure the answer to the question: Can the EVM’s Internal ...
1
vote
1answer
35 views

Is it possible to use low mining complexity to remove some certain transaction in the past?

I have a question that has concerned me for a long time. It relates to the security and reliability of the blockchain applications. Let's assume I want to build an application that uses Ethereum or ...
4
votes
1answer
188 views

ERC20 transfer - caller expects return but none provided - what happens?

If someone implements the ERC20 transfer() function without the return value as follows: function transfer(address to, uint256 value) public { require( ... usual checks ... ); balances_[msg....
2
votes
0answers
135 views

Who created this alt-Ropsten blockchain and why?

I usually test on Rinkeby, but this week I have to test some mining stuff, so I tried to get synced up with Ropsten. Unfortunately, after 3 days of trying, I still haven't had any success. The main ...
1
vote
1answer
292 views

Best practices for a secure Ethereum private network? [closed]

What are the best practices for an Ethereum private network with n nodes (programmed with Geth), to be secure from possibles external attacks? I mean, which config parameters are recommended during ...
1
vote
1answer
237 views

What is the Eclipse attack and how was it fixed in Ethereum?

In this paper the researchers describe the Eclipse attack https://eprint.iacr.org/2015/263.pdf. Can someone explain it briefly, what steps an attacker needs to take to perform the attack and how it ...
6
votes
2answers
742 views

How does the 'secret chain' catch up with the real chain in the long range attack?

I'm trying to dig deep into Casper and one of the things that keep coming up is the long-range attack in PoS. I understand the attack at a high level - basically you would go back some large amount of ...
4
votes
1answer
862 views

Dealing with the short address attack

I'm writing a contract for an ERC20 token, based on Zepellin contracts. I noticed that their code doesn't handle the short address attack. Does it mean I shouldn't care about it?
1
vote
0answers
19 views

Why an attacker needs ~2^128 computing power to spoof membership of a key/value pair in a trie?

Ethereum Wiki: Every unique set of key/value pairs maps uniquely to a root hash, and it is not possible to spoof membership of a key/value pair in a trie (unless an attacker has ~2^128 ...
0
votes
1answer
31 views

Leverage short positions in decentralised PoW currencies

Hint I asked this question in a similar style already on bitcointalk and on bitcoin.stackexchange. But in these threads, there are no good answers and I thought maybe it would be better to ask the ...
1
vote
1answer
175 views

Unable to replicate short-address attack

I was reading about the short address attack and decided to replicate and test the possible solutions. What I know about short address attack is if you skip n characters of your address, you end up ...
0
votes
1answer
350 views

What are the most common attack patterns on a Smart Contract? [duplicate]

i'm new to Solidity. After writing my first smart contract im fairly concerned about it's security, once deployed to the MainNet. What are the most important things i should check within my code? ...
6
votes
2answers
517 views

Is sending some datas in the data field safe?

An airdrop ask to send it 0ETH with 150000 GAS and some datas in DATA field. Is it safe? What could be the aim of this transaction? Thanks.
5
votes
1answer
104 views

Plasma.io: What if someone is offline during a mass withdrawal?

I'm reading the Plasma paper published a couple months ago, and on page 27, they talk about "Adversarial Mass Withdrawals" in the event of block withholding. My question is, what if someone is ...
3
votes
1answer
1k views

Is it Safe to Share the Wallet Keystore File Without Password?

There is an ICO that asks for ethereum keystore file, which is unusual for me as far as ICOs go. Even though it does not looks like it contains private key and password it still feels unsettling. Is ...
2
votes
3answers
418 views

In ethereum, what happen if someone controls a large majority of mining power?

If someone manages more than 50% of the mining power, this situation necessarily compromises the integrity of the past blocks and newly generating blocks?
1
vote
2answers
388 views

What if a malicious party sends two transactions with same nonce?

It's said nonce is used to prevent reply/double-spending attack. But an adversary can send two transactions with the same nonce, and the rest of scenario will be the same as in Bitcoin. Question 1: ...
4
votes
1answer
110 views

Can an Ethereum key generated on a laptop be brute-forced by someone else because of low entropy?

I read this and this tweets. Though, I understand that this issue occur because some people use the same private key mentioned in a blog/forum. But, on the first tweet, people were talking about the ...
3
votes
0answers
203 views

Did f2pool manipulate transactions during the Status ICO?

Blocks such as this one and this one appear to show preferential treatment being given to f2pool transactions in blocks mined by f2pool during the beginning of the Status ICO (at block height 3903900)....
1
vote
0answers
89 views

Account/Contract address of people responsible for Ethereum Attacks?

I believe there has been a hard fork following the DAO attack; I guess it's not possible to get the contract/account address for the person responsible, unless I am wrong and there is a way, please ...
2
votes
1answer
185 views

What is a “51% spawn camp attack”, and is it any different from a normal 51% attack

What is a "51% spawn camp attack", and is it any different from a normal 51% attack. Saw this mentioned in this tweet from Vitalik. Is there a distinction that I am missing?
1
vote
1answer
192 views

DAPP vs Consensus attacks

Are contracts such as DAPPs on the Ethereum block chain vulnerable to consensus attacks like Bitcoin is, such as say, to Gambler's ruin?
35
votes
5answers
7k views

Ropsten testnet is under kind of attack? What can we do?

For the last approximately 24 hours, Ropsten testnet is under an attack in my opinion. The gas limit is raised to 200m and the attacker was proposing blocks with more than 4,000 internal txs ...
5
votes
1answer
696 views

During which blocks did the DDos attack create millions of empty accounts?

This post (Why were empty accounts allowed to be on the blockchain?) discusses the Ddos attack from fall 2016. It mentions that nearly 20,000,000 account were created and then immediately deleted ...
9
votes
1answer
264 views

How was the state-bloat attack that led to the EIP 150 hardfork performed?

I understand that SELFDESTRUCT and mispricing of opcodes allowed many empty accounts to be created cheaply as explained in Why were empty accounts allowed to be on the blockchain? The answer to that ...
1
vote
0answers
132 views

Are there any real examples of Sybil attack? [closed]

I have seen many articles and blog posts talking about Sybil attack but except the case of Tor (Article Link), i couldn't find any relevant articles pointing to the Sybil attack on Computer Networks ...
3
votes
1answer
57 views

How to count empty accounts?

Is there a way to count empty accounts using geth ? I just want to be able to track current DDOS cleanup process.
2
votes
0answers
75 views

What is an empty account if the state root is not empty?

"State-bloat" attacks led to an empty account being defined as an account that has zero balance, nonce and code. There was a disagreement on EIP 161: I disagree. An account should be considered ...
14
votes
1answer
661 views

Why were empty accounts allowed to be on the blockchain?

It's hard to see what the benefits of allowing empty accounts to be on the blockchain are. This was a known subtlety (see "note: there is a difference between zero-balance and nonexistent") and ...
23
votes
2answers
44k views

Why is my node synchronization stuck/extremely slow at block 2,306,843?

Using macOS 10.12.1 with Ethereum Wallet 0.8.7, nodes are connected but Sync doesn't even start. Stuck at block 2,306,843. What can I do? Please keep in mind, I am neither a coder nor a tech geek.
3
votes
2answers
307 views

Can a potential bug in the ethereum VM be used to deploy a trojan on every node in the ethereum network?

This has been on the back of my mind for a long time but has resurfaced with the recent dos attacks. The constructor of a smart contract is executed by all nodes at the time of contract deployment. ...
1
vote
1answer
234 views

Running Wallet 0.8.6 with Parity 1.3.8 [Low # peers, Low speed] [duplicate]

Wondering why my blocks are processing so slowly. Peers ranging from 0 to 10. About 45,000 blocks behind... Processing 1 block about every 5 seconds.
2
votes
1answer
596 views

When will the Baddies have access to the hacked funds on the Ethereum Classic chain?

The Baddies drained 3641694.241898506992612606 ETH via The DAO's child DAO #59. When will the Baddies have access to the hacked funds on the Ethereum Classic chain? See also: Which split proposal ...
2
votes
1answer
183 views

Reproducing recursive call exploit

Here's a contract that I want to attack using recursive call: contract Abstract { function foobar(); } contract B { uint stateVar; function foo(Abstract someAddress){ ...
3
votes
2answers
253 views

Give some examples of documentation that talks about reentrancy attacks / recursive call vulnerabilities

The DAO, a smart-contract on Ethereum, was vulnerable to reentrancy attacks and 3 million ETH worth $50 million was stolen from it. What are some examples of content that mentions reentrancy attacks? ...
3
votes
2answers
352 views

Besides TheDAO - what are some examples of where Ether has been hacked, stolen or lost?

Besides TheDAO - what are some examples of where Ether has been hacked, stolen or lost ?
-1
votes
1answer
142 views

Why the DAO hacker could single handedly crash the ETC market many times over? [closed]

Disclosure: I started to read about crypto-coins a couple days ago. I read in this post comments that the DAO hacker, who holds many ETC (non-forked chain), can crash the market for good and end ETC ...
2
votes
0answers
331 views

Can Ethereum be shut down?

How realistic is to shutdown Ethereum network, so the smart contracts won't be executed anymore? Are there any practical or theoretical destructive ways to do it? Intentionally or not? Like a ...

1 2