Skip to main content

Questions tagged [attacks]

attempts by malicious users or software to subvert/manipulate the behaviour of an application or network

Filter by
Sorted by
Tagged with
3 votes
2 answers
1k views

How did I get my private key stolen?

Recently i received around 1400 USDC on my Ethereum wallet that I access through Metamask. Today I opened Metamask because I wanted to transfer those USDC, but I found that there were no USDC anymore ...
2 votes
2 answers
55 views

How much ETC was stolen in the multiple 51% attacks on Ethereum-Classic?

Ethereum Classic was attacked multiple times back in 2020. How much was stolen and which addresses control these stolen funds now? And have they been sold?
6 votes
2 answers
92 views

Can the `totalSupply` of a token be different than the sum of all account balances?

If I'm building a rebase token that has a difference of 1 wei sometimes (pre/post rebase) between the totalSupply and the sum of the balances of all holders, does that pose an attack risk within the ...
0 votes
0 answers
28 views

Failed to demonstrate a Re-entrancy attack due to arithmetic underflow

I try to do re-entrancy on a contract for testing purposes, but I encountered an error when doing so. Here's the targeted contract // SPDX-License-Identifier: MIT pragma solidity ^0.8.20; import {...
0 votes
0 answers
25 views

Malicious ERC20 blocking batch withdrawals of tokens (e.g. ERC777)

I was wondering whether the following attack vector is possible in practice. There's a batch transfer function that is intended to batch transfer the tokens owned by the contract. That function ...
3 votes
1 answer
627 views

What is a returnbomb attack?

I've read that when making an external call to an unknown contract, if the contract returns a large amount of random or junk byte it will cause some type of bug. But I dont know exact what it is and ...
0 votes
1 answer
76 views

Gas griefing in "typed" external calls

I was wondering whether the "insufficient gas griefing attack" is possible in cases when the external call is a typed call rather than an inline call with lower level utility functions (i.e. ...
0 votes
1 answer
19 views

How do hackers fund their Ethereum gas for attacking contracts?

I was wondering how do hackers fund their Ethereum balances privately to further execute attacks? What protocols do they usually use?
0 votes
0 answers
9 views

What's the difference between vVISR and VISR?

I am looking for post-mortem of Visor Finance incident on 2021. I am studying re-entrancy attack, but I am not sure what's the difference between vVISR and VISR. Is that a w (wrapped) thing?
2 votes
1 answer
167 views

Why Read-only reentrancy needs extra contract?

I need help on this structure. I understand about reentrancy attack but I still figuring out read-only reentrancy why it needs extra 'A' contract.
0 votes
1 answer
15 views

Question about Ethernaut Telephone question. Creating attack method instead of using constructor

This is entire contract for the ethernaut Telephone question. I created attack() function, but a youtuber suggests constructor(). Anyone knows why?
1 vote
2 answers
214 views

How is the ethereum network protected against bombardment with invalid transactions?

I am wondering what would happen to ethereum's mempool if it was bombarded with tons and tons of invalid transactions. Not even reverting transactions, because they cost gas, but against completely ...
1 vote
0 answers
54 views

What kind of malicious activity could an RPC gateway inflict on the user?

Let's say, a third-party RPC gateway for an Ethereum-like networks decided to turn itself into a malicious one. Apart from the likes of selling users' data, what kind of malicious activity could it ...
2 votes
1 answer
343 views

Questions about selfdestruct

What is the exact signature of selfdestruct? (parameters, return type, ..). I couldn't find it. Where can I find it by my self? Does the address given to selfdestruct is used to send the remaining ...
10 votes
3 answers
841 views

Commit-Reveal contract still vulnerable to front running. How can it be improved?

I'm writing a contract and I want to shield it from front-running as best as it can possible be done (obviously, fully preventing front running would be ideal). My implementation is very similar to ...
1 vote
2 answers
116 views

Is ChainLink's VRF susceptible to a 51% attack?

I do not know all of the details of how ChainLink's nodes and oracles work (hence why I am on here) but I did a little research on my own. According to a Gemini blog post by Cryptopedia, chainlink ...
1 vote
2 answers
448 views

What is the work of self destruct in a contract?

How it can be used for handling force sending of ether to a contract without triggering fallback function ?
1 vote
1 answer
104 views

Does sandwich attack work if there are TWO attackers?

In this scenerio, could both attackers turn a profit from this attack? I imagine it would work, but I want to be certain. Tx No. Description Tx0 Attacker 1 trades A for B Tx1 Attacker 2 trades A ...
1 vote
2 answers
127 views

How does ethereum testnets prevent DoS attack without expensive fees

Gas fees, among other things, make spamming expensive and thus prevent attackers to emit thousands of transactions. Since testnets have no fees (or "free" tokens), what really prevents ...
1 vote
2 answers
189 views

adaptive vs. non-adaptive adversaries? Is there a precise, unique and general definition? (Updated)

In this Ethereum github page (Link to the page: https://github.com/ethereum/wiki/wiki/Sharding-FAQ#what-are-the-security-models-that-we-are-operating-under) there is a very brief definition of the ...
1 vote
1 answer
122 views

How does proof-of-stake handle a denial-of-service attack?

As I understand it, the current proof-of-stake model works where one validator proposing a new block, and the block is accepted if enough validators approve it. What happens if someone performs a DoS ...
6 votes
0 answers
200 views

Kademlia: How does Ethereum uses node discovery protocol to avoid sybil/eclipse attacks?

I want to describe a case that's not clear to me. let's say we have 10 peer validator nodes who reach consensus and agree to store some blocks on their chain. Let's say now that a wallet wants to sync ...
2 votes
1 answer
129 views

How do Ethereum nodes defend against DDoS attacks by mass reading?

Suppose a bad actor has large amounts of data stored on a smart contract. Since reading data is free (doesn't need a transaction), what stops one from simply reading that data over and over again, ...
2 votes
1 answer
392 views

how do we use `commit/reveal` to count votes?

Let's say we are doing an election and it's easy to note that we need commit/reveal scheme to hide votes. So, we store hashes while users commit their votes. Now, let's say the election is over. How ...
1 vote
1 answer
36 views

What's stopping me from attacking the network by renting 51% of the stake for a few blocks?

The Ethereum market cap today is about $200bn. Theoretically, buying 51% of it would cost a stunning $100bn. Good luck getting that money hahah. However, I could ideally rent 51% of the staked eth for ...
7 votes
3 answers
1k views

What is a Sybil attack?

The term "Sybil Attack" comes up often when discussing network security with researchers. What is it? How much of a concern is it to the Ethereum network? What are some effective ways to prevent it?
0 votes
1 answer
132 views

Why is it called a 51% attack if you need 2/3 of total stake in Proof of Stake?

Validation schemes require 2/3 of total stake to agree on the next block in proof of stake, so, if I'm a bad actor, outpacing honest validators requires 2/3 of total stake. Yet, attacks from malicious ...
0 votes
1 answer
689 views

Flash loan price manipulation

I am quite new to flash loan and I don't fully understand it. I've been reading on flash loan attacks lately and notice often times it involves a huge dump on Uniswap to skew the price of a coin. I am ...
10 votes
3 answers
2k views

Flash loan security considerations and attacks

What do developers need to be aware of to make their contracts and systems safe against flash loans? What do they have to think about and protect against?
1 vote
0 answers
29 views

Understand this TX (attack on pancakeswap)

Can someone help me understand how this attack works? https://bscscan.com/tx/0x6781925966f5236c057d425e00378e4d4b8685c49eae9ddf48229ebcba682463 He basically SWAPS 0.000000001 BNB for some otkens, and ...
0 votes
1 answer
50 views

When we say that a 51% control of total computation power could lead to a successful Sybil attack, do we refer to miners or nodes?

As per my understanding of the blockchain so far (Bitcoin and Ethereum) nodes and miners have different jobs to do in a blockchain network. Although the terms are extensively used interchangeably, ...
1 vote
1 answer
203 views

Flash minting ether security considerations and attacks

Flash loans enable a class of attacks that have not been possible or observed as much in prior systems. Flash minting ether is a concept that is starting to be implemented. See Example of flash ...
0 votes
1 answer
132 views

How do these 2 functions differ in terms of security?

How are these 2 functions different in terms of security, there was a question on a forum and i don't understand function emergencyWithdraw(uint256 _pid) public { PoolInfo storage pool = poolInfo[...
1 vote
1 answer
173 views

Risk of Messages Not Having a Signature

As per my understanding transactions are signed before sending to Ethereum. Else, no transfer of Ether will happen. However, messages sent to Smart Contracts (SC) aren't signed (e.g., using methods....
0 votes
1 answer
145 views

Security considerations: using events to trigger offchain actions

I need to trigger a sensitive offchain action based on a users interaction with my smart contract. My current approach is to emit and event (Trigger(msg.sender, 123)) and then use a filterQuery with ...
1 vote
1 answer
34 views

can someone explain this line of the whitepaper?

To show how ethereum had made it's language turing-complete Vitalik in his white paper gave this example: "To show the motivation behind our solution(i.e using gas), consider the following ...
1 vote
1 answer
158 views

How can I demonstrate attacks on Quorum-based smart contracts in my local test network?

Currently, I am conducting a research regarding the security and privacy vulnerabilities of Quorum-based smart contracts. However, so far I've been struggling to implement attack vectors in order to ...
0 votes
1 answer
28 views

How does the oracle judge whether the request has been attacked by a man in the middle

The oracle machine can initiate a request to the data source whose URL is the HTTP link address. How does the oracle machine determine whether the HTTP request has been attacked by a man-in-the-middle,...
4 votes
3 answers
2k views

how does commit/reveal solve front-running?

I am trying to make sure I understand something correctly, so I will pose a problem with a solution. Problem: Let's say commit has been called. After this, we call the reveal. attacker listens to ...
0 votes
2 answers
995 views

how can we stop front running for `approve` [duplicate]

function approve(address _spender, uint256 _value) returns (bool success) This is the ordinary ERC20 approval method. It's easy to figure out that we have a problem of front-running. Alice gives ...
0 votes
1 answer
51 views

question about smart contract code possible vulnerability

I need help with one of my smart contracts. I wrote a smart contract that have functions that only emit events. The parameters of each event are some of the functions parameters. I want to ask if ...
1 vote
1 answer
32 views

can we jam the ETH network with assert/require functions?

If we make for example a smart contract with a require function that is always false and we execute it tons of times (knowing that we will get our gas back cause of the revert function)will we be able ...
0 votes
1 answer
61 views

Leverage short positions in decentralised PoW currencies

Hint I asked this question in a similar style already on bitcointalk and on bitcoin.stackexchange. But in these threads, there are no good answers and I thought maybe it would be better to ask the ...
4 votes
0 answers
1k views

Frontrunning Uniswap horror story transactions

From the Ethereum is a Dark Forest post, the rescue plan was: Deploy a Getter contract which, when called by its owner, would make the burn call ONLY if activated, and otherwise revert. Deploy a ...
3 votes
0 answers
329 views

Did f2pool manipulate transactions during the Status ICO?

Blocks such as this one and this one appear to show preferential treatment being given to f2pool transactions in blocks mined by f2pool during the beginning of the Status ICO (at block height 3903900)....
4 votes
1 answer
869 views

What is the "pre-commit" scheme to defeat frontrunning attack?

I am writing to inquire feasible strategies to defeat Transaction Ordering Dependence (TOD) bugs. I learned from the best practice guideline such that we can use a so-called "pre-committed" scheme ...
0 votes
1 answer
60 views

DaoAttack not working

I am trying to replicate the famous DAO attack for a cryptocurrencies course. I have the following contract already deployed on the blockchain. pragma solidity ^0.5.4; contract EDao { address ...
40 votes
2 answers
28k views

What exactly is the Nothing-At-Stake problem?

What exactly is the Nothing-At-Stake problem in Proof-of-Stake consensus networks? While I understand what the nothing at stake problem means, I do not really understand the security implications. ...
2 votes
1 answer
65 views

Is the May 2017 contract creation attack still possible?

In May 2017, an "attacker" created a contract that attempts to create many other contracts(using many JUMPDEST operations in the creation bytecode) until it runs out of gas. I see the gas ...
0 votes
1 answer
163 views

Integrity of old blocks in the blockchain

I am learning Ethereum using Geth, and I am testing PoA-Clique networks. Now I have a conceptual doubt about old blocks integrity. Suppose I have a private blockchain network of only one miner node ...