Questions tagged [attacks]
attempts by malicious users or software to subvert/manipulate the behaviour of an application or network
94
questions
0
votes
0answers
13 views
How did Ethereum prevent 51% attack in the initial stage?
As far as I've known, Ethereum used Proof of Work as its consensus protocol. In the initial stage, the hash power of the Ethereum Network was small, so how Ethereum prevented 51% attack at that time?
2
votes
1answer
33 views
Is the May 2017 contract creation attack still possible?
In May 2017, an "attacker" created a contract that attempts to create many other contracts(using many JUMPDEST operations in the creation bytecode) until it runs out of gas.
I see the gas ...
0
votes
0answers
13 views
Whats prevents malicious node to spam the network with invalid transactions or invalid blocks?
Every peer of the malicious node will validate the transactions and or the block to confirm it is invalid. They won`t propagate it to the network but it still consumes bandwith and computing power. So ...
0
votes
1answer
25 views
DaoAttack not working
I am trying to replicate the famous DAO attack for a cryptocurrencies course.
I have the following contract already deployed on the blockchain.
pragma solidity ^0.5.4;
contract EDao {
address ...
0
votes
1answer
28 views
Integrity of old blocks in the blockchain
I am learning Ethereum using Geth, and I am testing PoA-Clique networks. Now I have a conceptual doubt about old blocks integrity. Suppose I have a private blockchain network of only one miner node ...
0
votes
1answer
30 views
Transaction Timing Implications for Reentry Attacks
This is the classic reentry attack:
function withdrawBalance() public {
uint amountToWithdraw = userBalances[msg.sender];
(bool success, ) = msg.sender.call.value(amountToWithdraw)("");
...
0
votes
0answers
44 views
Can you verify transaction data by matching it to the transaction hash
TlDr; Can you use the transaction hash to confirm the integrity of the data components of a transaction (post data, addresses, nonce, etc).
In my application, I have a connection to the Ethereum ...
1
vote
1answer
35 views
Risk of Messages Not Having a Signature
As per my understanding transactions are signed before sending to Ethereum. Else, no transfer of Ether will happen. However, messages sent to Smart Contracts (SC) aren't signed (e.g., using methods....
4
votes
1answer
128 views
What is the “pre-commit” scheme to defeat frontrunning attack?
I am writing to inquire feasible strategies to defeat Transaction Ordering Dependence (TOD) bugs.
I learned from the best practice guideline such that we can use a so-called "pre-committed" scheme ...
0
votes
1answer
130 views
Griefing Attacks: Are they profitable for the attacker?
The following article explains one of the solutions for indirectly validate a block when cross-sharding transaction between two shards to prevent invalid blocks.
The article called one of these ...
1
vote
1answer
56 views
adaptive vs. non-adaptive adversaries? Is there a precise, unique and general definition? (Updated)
In this Ethereum github page (Link to the page: https://github.com/ethereum/wiki/wiki/Sharding-FAQ#what-are-the-security-models-that-we-are-operating-under) there is a very brief definition of the ...
2
votes
1answer
34 views
Would a 51% attack be easier if an attacker can DoS certain nodes?
I am wondering whether a 51% attack would be simplified by being able to remotely crash miner nodes. Consider the following scenario:
Malicious mining pool A controls 16% percent of the mining power ...
3
votes
1answer
48 views
Understand the trending of newly-uploaded smart contracts that is considered as vulnerable
We tried to use Oyente to analyze some online contracts and drawed a diagram regarding the potentially vulnerable smart contracts ("reentrancy" bug) with respect to their creation time.
So the y-...
0
votes
2answers
110 views
Create two contracts that each with different accounts.
I'm a newbie in blockchain. I am trying to repeat DAO attack using two different contracts, in my case DAO and Hacker. I want the 2 contracts belongs to 2 separated account, so I can see that the ...
0
votes
1answer
75 views
What is the work of self destruct in a contract?
How it can be used for handling force sending of ether to a contract without triggering fallback function ?
0
votes
0answers
92 views
A couple of questions on the Short Address attack
I have a few questions on the Short Address attack:
Is it possible to apply this attack on a function which does not take encoded byte-code as input and execute it, for example - function func(bytes ...
4
votes
1answer
105 views
Did DAO attacker gained ETH on Ethereum Classic?
I'm starting to study blockchain's world and the DAO attack caught my attention.
I studied how it worked and the solution proposed by the Ethereum community.
The hard fork splitted the blockchain in ...
3
votes
0answers
188 views
Denial attacks by submitting transactions with strategically calculated gas prices
As can be understood from the title, there is a specific form of denial attack where specific transactions are blocked by submitting transactions with strategically calculated gas prices.
Example 1: ...
1
vote
1answer
318 views
How does the exploit in FOMO3D work?
With the recent release of the FOMO3D exploit in its smart contract, how does the exploit work?
1
vote
1answer
62 views
Account management risks of booting into Tails OS from USB using a “partially air-gapped” Linux PC
My threat tolerance is around a 3 out of 5 on the paranoia scale. What are the practical account management risks of using a flash drive loaded with Tails OS to boot into a Linux PC, which will only ...
2
votes
3answers
152 views
Are Ethereum Contracts Vulnerable to Hash Table Poisoning Attacks?
Does anybody know something about this? I know that in general terms we will say not, but looking on the internet I found that isn't sure the answer to the question:
Can the EVM’s Internal ...
1
vote
1answer
42 views
Is it possible to use low mining complexity to remove some certain transaction in the past?
I have a question that has concerned me for a long time. It relates to the security and reliability of the blockchain applications.
Let's assume I want to build an application that uses Ethereum or ...
4
votes
1answer
261 views
ERC20 transfer - caller expects return but none provided - what happens?
If someone implements the ERC20 transfer() function without the return value as follows:
function transfer(address to, uint256 value) public {
require( ... usual checks ... );
balances_[msg....
2
votes
0answers
151 views
Who created this alt-Ropsten blockchain and why?
I usually test on Rinkeby, but this week I have to test some mining stuff, so I tried to get synced up with Ropsten. Unfortunately, after 3 days of trying, I still haven't had any success. The main ...
1
vote
1answer
338 views
Best practices for a secure Ethereum private network? [closed]
What are the best practices for an Ethereum private network with n nodes (programmed with Geth), to be secure from possibles external attacks?
I mean, which config parameters are recommended during ...
1
vote
1answer
260 views
What is the Eclipse attack and how was it fixed in Ethereum?
In this paper the researchers describe the Eclipse attack https://eprint.iacr.org/2015/263.pdf. Can someone explain it briefly, what steps an attacker needs to take to perform the attack and how it ...
6
votes
2answers
796 views
How does the 'secret chain' catch up with the real chain in the long range attack?
I'm trying to dig deep into Casper and one of the things that keep coming up is the long-range attack in PoS. I understand the attack at a high level - basically you would go back some large amount of ...
5
votes
3answers
948 views
Dealing with the short address attack
I'm writing a contract for an ERC20 token, based on Zepellin contracts. I noticed that their code doesn't handle the short address attack. Does it mean I shouldn't care about it?
1
vote
0answers
19 views
Why an attacker needs ~2^128 computing power to spoof membership of a key/value pair in a trie?
Ethereum Wiki:
Every unique set of key/value pairs maps uniquely to a root hash, and
it is not possible to spoof membership of a key/value pair in a trie
(unless an attacker has ~2^128 ...
0
votes
1answer
42 views
Leverage short positions in decentralised PoW currencies
Hint
I asked this question in a similar style already on bitcointalk and on bitcoin.stackexchange. But in these threads, there are no good answers and I thought maybe it would be better to ask the ...
1
vote
1answer
189 views
Unable to replicate short-address attack
I was reading about the short address attack and decided to replicate and test the possible solutions.
What I know about short address attack is if you skip n characters of your address, you end up ...
0
votes
1answer
378 views
What are the most common attack patterns on a Smart Contract? [duplicate]
i'm new to Solidity.
After writing my first smart contract im fairly concerned about it's security, once deployed to the MainNet. What are the most important things i should check within my code? ...
6
votes
2answers
613 views
Is sending some datas in the data field safe?
An airdrop ask to send it 0ETH with 150000 GAS and some datas in DATA field.
Is it safe?
What could be the aim of this transaction?
Thanks.
5
votes
1answer
110 views
Plasma.io: What if someone is offline during a mass withdrawal?
I'm reading the Plasma paper published a couple months ago, and on page 27, they talk about "Adversarial Mass Withdrawals" in the event of block withholding.
My question is, what if someone is ...
3
votes
1answer
1k views
Is it Safe to Share the Wallet Keystore File Without Password?
There is an ICO that asks for ethereum keystore file, which is unusual for me as far as ICOs go. Even though it does not looks like it contains private key and password it still feels unsettling.
Is ...
2
votes
3answers
434 views
In ethereum, what happen if someone controls a large majority of mining power?
If someone manages more than 50% of the mining power, this situation necessarily compromises the integrity of the past blocks and newly generating blocks?
1
vote
2answers
466 views
What if a malicious party sends two transactions with same nonce?
It's said nonce is used to prevent reply/double-spending attack. But an adversary can send two transactions with the same nonce, and the rest of scenario will be the same as in Bitcoin.
Question 1: ...
4
votes
1answer
118 views
Can an Ethereum key generated on a laptop be brute-forced by someone else because of low entropy?
I read this and this tweets. Though, I understand that this issue occur because some people use the same private key mentioned in a blog/forum.
But, on the first tweet, people were talking about the ...
3
votes
0answers
212 views
Did f2pool manipulate transactions during the Status ICO?
Blocks such as this one and this one appear to show preferential treatment being given to f2pool transactions in blocks mined by f2pool during the beginning of the Status ICO (at block height 3903900)....
1
vote
0answers
91 views
Account/Contract address of people responsible for Ethereum Attacks?
I believe there has been a hard fork following the DAO attack; I guess it's not possible to get the contract/account address for the person responsible, unless I am wrong and there is a way, please ...
2
votes
1answer
206 views
What is a “51% spawn camp attack”, and is it any different from a normal 51% attack
What is a "51% spawn camp attack", and is it any different from a normal 51% attack. Saw this mentioned in this tweet from Vitalik.
Is there a distinction that I am missing?
1
vote
1answer
198 views
DAPP vs Consensus attacks
Are contracts such as DAPPs on the Ethereum block chain vulnerable to consensus attacks like Bitcoin is, such as say, to Gambler's ruin?
37
votes
5answers
7k views
Ropsten testnet is under kind of attack? What can we do?
For the last approximately 24 hours, Ropsten testnet is under an attack in my opinion. The gas limit is raised to 200m and the attacker was proposing blocks with more than 4,000 internal txs ...
5
votes
1answer
812 views
During which blocks did the DDos attack create millions of empty accounts?
This post (Why were empty accounts allowed to be on the blockchain?) discusses the Ddos attack from fall 2016. It mentions that nearly 20,000,000 account were created and then immediately deleted ...
9
votes
1answer
322 views
How was the state-bloat attack that led to the EIP 150 hardfork performed?
I understand that SELFDESTRUCT and mispricing of opcodes allowed many empty accounts to be created cheaply as explained in Why were empty accounts allowed to be on the blockchain? The answer to that ...
1
vote
0answers
136 views
Are there any real examples of Sybil attack? [closed]
I have seen many articles and blog posts talking about Sybil attack but except the case of Tor (Article Link), i couldn't find any relevant articles pointing to the Sybil attack on Computer Networks ...
3
votes
1answer
67 views
How to count empty accounts?
Is there a way to count empty accounts using geth ? I just want to be able to track current DDOS cleanup process.
3
votes
0answers
87 views
What is an empty account if the state root is not empty?
"State-bloat" attacks led to an empty account being defined as an account that has zero balance, nonce and code.
There was a disagreement on EIP 161:
I disagree. An account should be considered ...
15
votes
1answer
745 views
Why were empty accounts allowed to be on the blockchain?
It's hard to see what the benefits of allowing empty accounts to be on the blockchain are. This was a known subtlety (see "note: there is a difference between zero-balance and nonexistent") and ...
25
votes
2answers
45k views
Why is my node synchronization stuck/extremely slow at block 2,306,843?
Using macOS 10.12.1 with Ethereum Wallet 0.8.7, nodes are connected but Sync doesn't even start. Stuck at block 2,306,843.
What can I do? Please keep in mind, I am neither a coder nor a tech geek.
