Questions tagged [attacks]
attempts by malicious users or software to subvert/manipulate the behaviour of an application or network
37
questions
40
votes
5
answers
9k
views
Ropsten testnet is under kind of attack? What can we do?
For the last approximately 24 hours, Ropsten testnet is under an attack in my opinion. The gas limit is raised to 200m and the attacker was proposing blocks with more than 4,000 internal txs ...
- 802
28
votes
2
answers
56k
views
Why is my node synchronization stuck/extremely slow at block 2,306,843?
Using macOS 10.12.1 with Ethereum Wallet 0.8.7, nodes are connected but Sync doesn't even start. Stuck at block 2,306,843.
What can I do? Please keep in mind, I am neither a coder nor a tech geek.
- 391
36
votes
3
answers
9k
views
What is a replay attack?
During the launch of the frontier network, users were cautioned not to reuse keys from the Olympic testnet in order to prevent "replay attacks". What is a replay attack, and why would re-using a key ...
- 22.1k
22
votes
3
answers
4k
views
TheDAO hack FAQ: How did the attack happen on 17 June 2016?
Can anyone explain that how the DAO attack happened? Vitalik Buterin explained here that it was performed by splitting a DAO from the main DAO but calling the split function recursively.
We know that ...
17
votes
2
answers
3k
views
During a 51% attack, What Can the Attacker Actually Accomplish?
During an attack on the network, where the attacker has more than 51% of hashing power (or the equivalent of Ether in PoS), what can the attacker do and not do to the chain and the contracts on it?
...
- 927
9
votes
1
answer
917
views
How many ethers have been drained through the recursive call attacks on The DAO?
The recursive call attacks on The DAO have now stopped as there are no more ethers in The DAO account.
What are the amounts and percentages that can be attributed to the hostile and friendly attacks, ...
- 40.3k
16
votes
1
answer
990
views
Why were empty accounts allowed to be on the blockchain?
It's hard to see what the benefits of allowing empty accounts to be on the blockchain are. This was a known subtlety (see "note: there is a difference between zero-balance and nonexistent") and ...
eth♦
- 85.7k
8
votes
1
answer
1k
views
How many The DAO recursive call vulnerability attacks have occurred to date?
The first identified The DAO recursive call vulnerability attack occurred on 17 June 2016, with the accounts identified in Which accounts are involved in mounting the recursive call vulnerability ...
- 40.3k
40
votes
2
answers
28k
views
What exactly is the Nothing-At-Stake problem?
What exactly is the Nothing-At-Stake problem in Proof-of-Stake consensus networks?
While I understand what the nothing at stake problem means, I do not really understand the security implications. ...
- 32.9k
10
votes
3
answers
2k
views
Flash loan security considerations and attacks
What do developers need to be aware of to make their contracts and systems safe against flash loans?
What do they have to think about and protect against?
eth♦
- 85.7k
9
votes
2
answers
1k
views
Is sending some datas in the data field safe?
An airdrop ask to send it 0ETH with 150000 GAS and some datas in DATA field.
Is it safe?
What could be the aim of this transaction?
Thanks.
3
votes
1
answer
395
views
Which split proposal was used to mount the recursive call vulnerability attack on The DAO?
I'm assuming that a split proposal was used to mount the recursive call vulnerability attack on The DAO.
Which of the splits below was used to mount this attack?
Here are the current list of splits:
...
3
votes
1
answer
479
views
Which accounts are involved in mounting the recursive call vulnerability attacks on The DAO?
The first transaction 0x0ec3f2488a93839524add10ea229e773f6bc891b4eb4794c3337d4495263790b was initiated from account 0x969837498944ae1dc0dcac2d0c65634c88729b2d to the contract at ...
14
votes
2
answers
7k
views
What is the Long-Range-Attack in Proof-of-Stake?
What is the Long-Range-Attack in Proof-of-Stake? And how will this vector be mitigated with the Casper Proof-of-Stake implementation?
- 32.9k
10
votes
1
answer
8k
views
Security measures to overcome 51% attack
I was reading During a 51% attack, What Can the Attacker Actually Accomplish?
from there, i understand the after-effects are something serious, so what are the security measures which ethereum have ...
- 9,673
5
votes
3
answers
2k
views
Dealing with the short address attack
I'm writing a contract for an ERC20 token, based on Zepellin contracts. I noticed that their code doesn't handle the short address attack. Does it mean I shouldn't care about it?
- 740
4
votes
1
answer
853
views
What is the "pre-commit" scheme to defeat frontrunning attack?
I am writing to inquire feasible strategies to defeat Transaction Ordering Dependence (TOD) bugs.
I learned from the best practice guideline such that we can use a so-called "pre-committed" scheme ...
- 257
30
votes
3
answers
4k
views
Is Ethereum secure against an attack by quantum computers?
Does Ethereum implement Post-quantum cryptography? Or will the network break once a malicious actor gains control of an effective quantum computer?
- 1,405
7
votes
1
answer
838
views
How much would 51% attack cost?
I was thinking about situation where for example NSA would want to gain control over significant portion of Ethereum network.
How much would it cost to for example create mining pool that would be ...
- 681
7
votes
2
answers
2k
views
How was the recursion created that lead to theDAO hack?
I understand that if theDAO contract has a withdrawal function that sends money to contract X - contract X can be malicious and use the fallback function to call the withdrawal function again. However ...
- 7,626
6
votes
2
answers
891
views
What was the second vulnerability used in The DAO attack on 17 June 2016?
From The big theDAO heist FAQ by koeppelmann:
How did the attack worked exactly? The attacker managed to combine 2 exploits. The first exploit was to call the split DAO function recursively. That ...
- 40.3k
5
votes
4
answers
594
views
In simple terms, how did the DAO get hacked and funds removed from it?
How did the DAO get hacked? Can someone explain in simple terms?
- 4,800
4
votes
3
answers
2k
views
how does commit/reveal solve front-running?
I am trying to make sure I understand something correctly, so I will pose a problem with a solution.
Problem:
Let's say commit has been called. After this, we call the reveal. attacker listens to ...
- 1,175
9
votes
1
answer
2k
views
What are the balances of The DAO and it's child DAOs on the Ethereum Classic chain?
At the hard-fork block #1,920,000, the ETH balance from The DAO and it's child DAOs (which includes the balance from the extraBalance account) were transferred into the Withdrawal contract.
What are ...
- 40.3k
9
votes
1
answer
498
views
How was the state-bloat attack that led to the EIP 150 hardfork performed?
I understand that SELFDESTRUCT and mispricing of opcodes allowed many empty accounts to be created cheaply as explained in Why were empty accounts allowed to be on the blockchain? The answer to that ...
eth♦
- 85.7k
6
votes
0
answers
190
views
Kademlia: How does Ethereum uses node discovery protocol to avoid sybil/eclipse attacks?
I want to describe a case that's not clear to me. let's say we have 10 peer validator nodes who reach consensus and agree to store some blocks on their chain. Let's say now that a wallet wants to sync ...
5
votes
2
answers
415
views
Can the stalker attack in TheDAO be stopped?
https://github.com/slockit/dao/wiki/Why-The-Stalker-attack-is-a-non-issue#a-way-to-guarantee-you-get-your-eth says:
Assuming the attacker also voted yes in all of the new Curator
Proposals, in ...
eth♦
- 85.7k
5
votes
1
answer
999
views
During which blocks did the DDos attack create millions of empty accounts?
This post (Why were empty accounts allowed to be on the blockchain?) discusses the Ddos attack from fall 2016. It mentions that nearly 20,000,000 account were created and then immediately deleted ...
- 9,943
4
votes
1
answer
146
views
Did the spamming counter-attack on The DAO attack work to slow down the attacks?
This question was asked in the comment section of What does TheDAO counter-attack by spamming actually do? (suggested by Stephan Tual).
Background links:
The attacks used a recursive call ...
- 40.3k
3
votes
2
answers
749
views
Can a potential bug in the ethereum VM be used to deploy a trojan on every node in the ethereum network?
This has been on the back of my mind for a long time but has resurfaced with the recent dos attacks.
The constructor of a smart contract is executed by all nodes at the time of contract deployment.
...
- 320
3
votes
1
answer
2k
views
Why are coins at risk when honestly staking?
It has been repeatedly written that staking nodes should buy DDoS protection or be at risk of losing their coins.
Can someone explain why an honest staker is at risk of losing his coins in case it ...
- 678
3
votes
0
answers
132
views
What is an empty account if the state root is not empty?
"State-bloat" attacks led to an empty account being defined as an account that has zero balance, nonce and code.
There was a disagreement on EIP 161:
I disagree. An account should be considered ...
eth♦
- 85.7k
3
votes
1
answer
530
views
How was the recursive call vulnerability attack conducted via proposal #59 when there were no Yes votes?
From Which split proposal was used to mount the recursive call vulnerability attack on The DAO?, proposal #59 is very likely the vector uses by the attacker to hack 3,641,694.241898506 Ether ($59,578,...
- 40.3k
2
votes
1
answer
673
views
When will the Baddies have access to the hacked funds on the Ethereum Classic chain?
The Baddies drained 3641694.241898506992612606 ETH via The DAO's child DAO #59.
When will the Baddies have access to the hacked funds on the Ethereum Classic chain?
See also:
Which split proposal ...
- 40.3k
2
votes
1
answer
619
views
What's happening within child DAO #59 on the ETC chain?
From What are the balances of The DAO and it's child DAOs on the Ethereum Classic chain? we know that the baddies have drained 3641694.241898506992612606 ETH from child DAO #59.
What is happening ...
- 40.3k
1
vote
1
answer
263
views
Running Wallet 0.8.6 with Parity 1.3.8 [Low # peers, Low speed] [duplicate]
Wondering why my blocks are processing so slowly. Peers ranging from 0 to 10. About 45,000 blocks behind... Processing 1 block about every 5 seconds.
0
votes
0
answers
165
views
A couple of questions on the Short Address attack
I have a few questions on the Short Address attack:
Is it possible to apply this attack on a function which does not take encoded byte-code as input and execute it, for example - function func(bytes ...
- 26k