Questions tagged [attacks]

attempts by malicious users or software to subvert/manipulate the behaviour of an application or network

Filter by
Sorted by
Tagged with
38
votes
5answers
8k views

Ropsten testnet is under kind of attack? What can we do?

For the last approximately 24 hours, Ropsten testnet is under an attack in my opinion. The gas limit is raised to 200m and the attacker was proposing blocks with more than 4,000 internal txs ...
33
votes
2answers
23k views

What exactly is the Nothing-At-Stake problem?

What exactly is the Nothing-At-Stake problem in Proof-of-Stake consensus networks? While I understand what the nothing at stake problem means, I do not really understand the security implications. ...
31
votes
3answers
6k views

What is a replay attack?

During the launch of the frontier network, users were cautioned not to reuse keys from the Olympic testnet in order to prevent "replay attacks". What is a replay attack, and why would re-using a key ...
27
votes
2answers
50k views

Why is my node synchronization stuck/extremely slow at block 2,306,843?

Using macOS 10.12.1 with Ethereum Wallet 0.8.7, nodes are connected but Sync doesn't even start. Stuck at block 2,306,843. What can I do? Please keep in mind, I am neither a coder nor a tech geek.
27
votes
3answers
4k views

Is Ethereum secure against an attack by quantum computers?

Does Ethereum implement Post-quantum cryptography? Or will the network break once a malicious actor gains control of an effective quantum computer?
21
votes
3answers
4k views

TheDAO hack FAQ: How did the attack happen on 17 June 2016?

Can anyone explain that how the DAO attack happened? Vitalik Buterin explained here that it was performed by splitting a DAO from the main DAO but calling the split function recursively. We know that ...
17
votes
2answers
2k views

During a 51% attack, What Can the Attacker Actually Accomplish?

During an attack on the network, where the attacker has more than 51% of hashing power (or the equivalent of Ether in PoS), what can the attacker do and not do to the chain and the contracts on it? ...
15
votes
1answer
815 views

Why were empty accounts allowed to be on the blockchain?

It's hard to see what the benefits of allowing empty accounts to be on the blockchain are. This was a known subtlety (see "note: there is a difference between zero-balance and nonexistent") and ...
12
votes
3answers
921 views

How are we going to mitigate DDoS Attacks in Proof of Stake?

I would like to know if I am connected to the network as a validator, how I my node will be protected of DDoS attacks.
12
votes
2answers
195 views

Is it possible to attack “the DAO” attackers new splitted DAO?

Since the splitted DAO (dark DAO) has the exact same vulnerability in its code, is it possible to execute the same attack to the attackers DAO?
10
votes
2answers
5k views

What is the Long-Range-Attack in Proof-of-Stake?

What is the Long-Range-Attack in Proof-of-Stake? And how will this vector be mitigated with the Casper Proof-of-Stake implementation?
9
votes
1answer
7k views

Security measures to overcome 51% attack

I was reading During a 51% attack, What Can the Attacker Actually Accomplish? from there, i understand the after-effects are something serious, so what are the security measures which ethereum have ...
9
votes
3answers
1k views

Can you attack/ddos/spam a single contract?

Can you make a denial of service attack against a Contract? By blocking a single contract (or ethereum-object) instance so it can't be executed? For example spamming it in some way, like repeadetly ...
9
votes
1answer
847 views

How many ethers have been drained through the recursive call attacks on The DAO?

The recursive call attacks on The DAO have now stopped as there are no more ethers in The DAO account. What are the amounts and percentages that can be attributed to the hostile and friendly attacks, ...
9
votes
1answer
2k views

What are the balances of The DAO and it's child DAOs on the Ethereum Classic chain?

At the hard-fork block #1,920,000, the ETH balance from The DAO and it's child DAOs (which includes the balance from the extraBalance account) were transferred into the Withdrawal contract. What are ...
9
votes
1answer
352 views

How was the state-bloat attack that led to the EIP 150 hardfork performed?

I understand that SELFDESTRUCT and mispricing of opcodes allowed many empty accounts to be created cheaply as explained in Why were empty accounts allowed to be on the blockchain? The answer to that ...
8
votes
4answers
791 views

Flash loan security considerations and attacks

What do developers need to be aware of to make their contracts and systems safe against flash loans? What do they have to think about and protect against?
8
votes
1answer
1k views

How many The DAO recursive call vulnerability attacks have occurred to date?

The first identified The DAO recursive call vulnerability attack occurred on 17 June 2016, with the accounts identified in Which accounts are involved in mounting the recursive call vulnerability ...
8
votes
2answers
124 views

Commit-Reveal contract still vulnerable to front running. How can it be improved?

I'm writing a contract and I want to shield it from front-running as best as it can possible be done (obviously, fully preventing front running would be ideal). My implementation is very similar to ...
7
votes
2answers
1k views

What is a Sybil attack?

The term "Sybil Attack" comes up often when discussing network security with researchers. What is it? How much of a concern is it to the Ethereum network? What are some effective ways to prevent it?
7
votes
2answers
2k views

How did they stop “the DAO” attack on 17 June 2016? [duplicate]

Is it possible to prevent some transactions from happening? Obviously not, since it will ruin the whole purpose of having a decentralized system. So my question is how could they stop the attack? In ...
7
votes
2answers
1k views

How was the recursion created that lead to theDAO hack?

I understand that if theDAO contract has a withdrawal function that sends money to contract X - contract X can be malicious and use the fallback function to call the withdrawal function again. However ...
7
votes
1answer
773 views

How much would 51% attack cost?

I was thinking about situation where for example NSA would want to gain control over significant portion of Ethereum network. How much would it cost to for example create mining pool that would be ...
6
votes
2answers
755 views

Is sending some datas in the data field safe?

An airdrop ask to send it 0ETH with 150000 GAS and some datas in DATA field. Is it safe? What could be the aim of this transaction? Thanks.
6
votes
2answers
799 views

What was the second vulnerability used in The DAO attack on 17 June 2016?

From The big theDAO heist FAQ by koeppelmann: How did the attack worked exactly? The attacker managed to combine 2 exploits. The first exploit was to call the split DAO function recursively. That ...
6
votes
2answers
843 views

How does the 'secret chain' catch up with the real chain in the long range attack?

I'm trying to dig deep into Casper and one of the things that keep coming up is the long-range attack in PoS. I understand the attack at a high level - basically you would go back some large amount of ...
6
votes
1answer
97 views

Could a proxy spigot contract have stopped the DAO fraud?

For anyone who doesn't know about the DAO exploit you can read up on it here. It seems to me like the attack could have been stopped if payouts went through another contract that was really simple ...
5
votes
4answers
547 views

In simple terms, how did the DAO get hacked and funds removed from it?

How did the DAO get hacked? Can someone explain in simple terms?
5
votes
3answers
1k views

Dealing with the short address attack

I'm writing a contract for an ERC20 token, based on Zepellin contracts. I noticed that their code doesn't handle the short address attack. Does it mean I shouldn't care about it?
5
votes
2answers
374 views

Can the stalker attack in TheDAO be stopped?

https://github.com/slockit/dao/wiki/Why-The-Stalker-attack-is-a-non-issue#a-way-to-guarantee-you-get-your-eth says: Assuming the attacker also voted yes in all of the new Curator Proposals, in ...
5
votes
1answer
121 views

Is it possible to use negative gas to execute a Reentrant attack using .send()?

Haven't tested it out but I think in theory this could work. It might work somehing like this: An attacker first writes a lot of data to storage so there is data to be deleted. Using .send() in the ...
5
votes
1answer
122 views

Plasma.io: What if someone is offline during a mass withdrawal?

I'm reading the Plasma paper published a couple months ago, and on page 27, they talk about "Adversarial Mass Withdrawals" in the event of block withholding. My question is, what if someone is ...
5
votes
1answer
859 views

During which blocks did the DDos attack create millions of empty accounts?

This post (Why were empty accounts allowed to be on the blockchain?) discusses the Ddos attack from fall 2016. It mentions that nearly 20,000,000 account were created and then immediately deleted ...
5
votes
1answer
114 views

Resilience to rogue miners

How will Ethereum stop evil-miner attacks where a gas-guzzling tx is added to a just-solved block to slow down competition once gasLimit goes high ? For relevant discussion see this reddit thread, ...
4
votes
1answer
122 views

Did the spamming counter-attack on The DAO attack work to slow down the attacks?

This question was asked in the comment section of What does TheDAO counter-attack by spamming actually do? (suggested by Stephan Tual). Background links: The attacks used a recursive call ...
4
votes
1answer
295 views

ERC20 transfer - caller expects return but none provided - what happens?

If someone implements the ERC20 transfer() function without the return value as follows: function transfer(address to, uint256 value) public { require( ... usual checks ... ); balances_[msg....
4
votes
1answer
119 views

Can an Ethereum key generated on a laptop be brute-forced by someone else because of low entropy?

I read this and this tweets. Though, I understand that this issue occur because some people use the same private key mentioned in a blog/forum. But, on the first tweet, people were talking about the ...
4
votes
1answer
238 views

Does the recent attack to “the DAO” means end of it? [duplicate]

However implementing the DAO and its smart contracts are incredibly exciting experiments, the recent attack to the DAO clearly suggested that the code is not safe and may or may not have more ...
4
votes
1answer
346 views

What is the “pre-commit” scheme to defeat frontrunning attack?

I am writing to inquire feasible strategies to defeat Transaction Ordering Dependence (TOD) bugs. I learned from the best practice guideline such that we can use a so-called "pre-committed" scheme ...
4
votes
1answer
114 views

Did DAO attacker gained ETH on Ethereum Classic?

I'm starting to study blockchain's world and the DAO attack caught my attention. I studied how it worked and the solution proposed by the Ethereum community. The hard fork splitted the blockchain in ...
4
votes
1answer
135 views

Is the DAO incident being investigated by law enforcement?

In current discussions about the DAO incident many people are using words like "theft" and "crime", while others say all transactions were stictly in accordance to a (maybe grossly unfair but) valid ...
4
votes
1answer
174 views

Are transactions on one chain automatically broadcasted to other chains?

I know how to split but I'd like to know if, technically, all transactions on the Ethereum chain are automatically broadcasted on the "Ethereum Classic" chain and vice-versa or if replay "attacks" ...
4
votes
0answers
127 views

How is Casper better than POW against possible government censorship? [closed]

As of now my understanding is that with POW an attack by one or multiple goverments could be orchestrated just by raiding mining farms (which can be easily identified given the electricity bill) and ...
3
votes
2answers
265 views

Give some examples of documentation that talks about reentrancy attacks / recursive call vulnerabilities

The DAO, a smart-contract on Ethereum, was vulnerable to reentrancy attacks and 3 million ETH worth $50 million was stolen from it. What are some examples of content that mentions reentrancy attacks? ...
3
votes
1answer
2k views

Is it Safe to Share the Wallet Keystore File Without Password?

There is an ICO that asks for ethereum keystore file, which is unusual for me as far as ICOs go. Even though it does not looks like it contains private key and password it still feels unsettling. Is ...
3
votes
2answers
369 views

Besides TheDAO - what are some examples of where Ether has been hacked, stolen or lost?

Besides TheDAO - what are some examples of where Ether has been hacked, stolen or lost ?
3
votes
1answer
2k views

Why are coins at risk when honestly staking?

It has been repeatedly written that staking nodes should buy DDoS protection or be at risk of losing their coins. Can someone explain why an honest staker is at risk of losing his coins in case it ...
3
votes
2answers
352 views

Is the DAO hardfork technically a 51% attack?

Can the DAO hardfork be viewed as a (a publicly planned) 51% attack on the network? Motivation / ethics / justice aside, I'm asking this from a purely technical point of view. If not, what ...
3
votes
1answer
361 views

Which accounts are involved in mounting the recursive call vulnerability attacks on The DAO?

The first transaction 0x0ec3f2488a93839524add10ea229e773f6bc891b4eb4794c3337d4495263790b was initiated from account 0x969837498944ae1dc0dcac2d0c65634c88729b2d to the contract at ...
3
votes
1answer
303 views

Which split proposal was used to mount the recursive call vulnerability attack on The DAO?

I'm assuming that a split proposal was used to mount the recursive call vulnerability attack on The DAO. Which of the splits below was used to mount this attack? Here are the current list of splits: ...