Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
0
votes
1answer
8 views

Gas optimisation for my art experiment spacecans.com

so I was microdosing some research chems and the thought came to me that I need to do some artsy blockchain stuff for once. It's two tin cans floating in space that you can advertise your so-called ...
2
votes
1answer
21 views

Getter functions for loop security

Is there any security issue when making for-loops inside getter functions ? Let's say the array is very large, and it takes a long time to loop through the array. Is it a potential threat or I can ...
1
vote
0answers
28 views

Help hacking this contract

This is a very simple contract that I can't hack and I'm stuck, I need some help to get the concepts right. pragma solidity ^0.4.10; contract SimpleToken { mapping(address => uint) public ...
0
votes
1answer
17 views

Risk of Messages Not Having a Signature

As per my understanding transactions are signed before sending to Ethereum. Else, no transfer of Ether will happen. However, messages sent to Smart Contracts (SC) aren't signed (e.g., using methods....
1
vote
1answer
18 views

How mining happen in private and permissioned blockchain?

In public blockchain a miner gets rewarded for mining a block. But in a private or permissioned blockchain, if there are no rewarding facilities available, how does the mining happen? Also, is it ...
0
votes
1answer
14 views

Is it safe to share my signed transaction publicly?

If someone got hold of my Ethereum signed transaction, is my wallet still safe? Can they extract the raw transaction from the signed transaction to get my private key?
0
votes
1answer
41 views

Solidity: extract data from signed message?

In an effort to reduce gas costs for users, I'm looking for a way to delegate certain transactions to a contract owner so that the owner makes a transactions that would have been otherwise sent by the ...
1
vote
1answer
41 views

Off-chain authorization system

I'm working on a dapp and am running into a dilemma regarding how to balance trustlessness with the cost of transactions for users. In order to reduce gas usage by users, I want to be able to able to ...
1
vote
0answers
11 views

How exactly theᴅᴀᴏ reentrancy hack was performed without having weiGiven>0 nor IsAllowed(WithdrawAddress)?

The well known ᴅᴀᴏ hack didn’t affect ether balances of theᴅᴀᴏ but balances of rewardAccount. That’s why I’m talking about the hack version which affected contract balances of theᴅᴀᴏ itself. With ...
1
vote
1answer
23 views

Is it possible to manipulate maximum callstack size in solidity?

I'm a student learning about solidity language. According to solidity's official docs, the maximum callstack size is 1024. But, I am wondering, can a developer change the maximum callstack size in ...
0
votes
1answer
12 views

Can I rely on certain oracle to know the precise and reliable timestamp?

I am learning the security impact of smart contract on system properties like block.timestamp and block.number. I understood that block.timestamp can be controlled by the miner to certain degree and ...
0
votes
1answer
12 views

What does this payment fragment mean?

I am trying to comprehend the following snippet of payment code: if (collectedFees >= minFeePayout) { if (!owner.send(collectedFees)) { // Potentially sending ...
3
votes
1answer
31 views

What is the “pre-commit” scheme to defeat TOD attack?

I am writing to inquire feasible strategies to defeat Transaction Ordering Dependence (TOD) bugs. I learned from the best practice guideline such that we can use a so-called "pre-committed" scheme ...
0
votes
0answers
21 views

how to implement erc1400 standard?

I am trying to learn about erc1400 and its implementation but couldn't find any complete implementation guide. Can someone points me to relevant links regarding erc1400 complete end to end ...
0
votes
1answer
45 views

Griefing Attacks: Are they profitable for the attacker?

The following article explains one of the solutions for indirectly validate a block when cross-sharding transaction between two shards to prevent invalid blocks. The article called one of these ...
1
vote
1answer
29 views

adaptive vs. non-adaptive adversaries? Is there a precise, unique and general definition? (Updated)

In this Ethereum github page (Link to the page: https://github.com/ethereum/wiki/wiki/Sharding-FAQ#what-are-the-security-models-that-we-are-operating-under) there is a very brief definition of the ...
1
vote
1answer
33 views

Strict Balance Equality (Security Issue)

Research Paper, Page-5(Strict Balance Equality)I have read that attacker can use Selfdestruct() and forcibly send ethers to the contracts. My questions are: If Selfdestruct is meant for owner of ...
0
votes
1answer
49 views

Proxy function clashing - what kind of danger comes exactly with it?

I read that if I am using proxy, there is a chance of function clashing. Let's say in my contract there is a function with a signature: proxyOwner() ...
0
votes
3answers
39 views

How do I attack the `Vuln` contract?

How can I steal from Vuln contract? I have made another contract to try to steal from Vuln but it always gives me an error. And I'm not sure how to send the money to my adrress. contract Vuln { ...
0
votes
1answer
47 views

User anonymity while submitting data in smart contract

I've written a smart contract, that is a crowd sensing system. Where post posting a task user view that task and if they have what I'm asking for/and meet the task requirements they submit certain ...
0
votes
1answer
7 views

How to restrict call to inherited public function

I'm using OpenZeppelin library for my project and I need to override some functions for business logic. But my concern is with given example, // contract from library contract A { function ...
1
vote
1answer
31 views

How to access a smart contract function protected by access rights using Web3?

I have a smart contract address for security tokens, and certain functions of it are protected by access rights, for which I have an address to access those functions, however I am not able to figure ...
0
votes
1answer
24 views

Is this implementation of multisig2of3.sol secure? [closed]

I implemented multisig 2 of 3 contract. Please give me feedback on codestyle, security and usability. On codereview there is only two solidity questions, so I posted here. see on github pragma ...
0
votes
0answers
24 views

Understand the `call` opcode in this contract

Hello, I am posting a quick question regarding the functionality this contract: https://etherscan.io/address/6b63ea3612dde97082aab468157950f927618d31#code From the source code, I am not even able to ...
0
votes
1answer
19 views

Understand the potential issue of miner controlled gaslimit

I am aware that smart contracts running on top of EVM can access certain system properties such as timestamp, block number, and gas limit. I am also aware that such properties can be controlled by ...
2
votes
2answers
826 views

Issue with New version of Metamask: Remix cannot detect the Metamask address

I have just installed Metamask version: 6.3.1 Now in Remix, the address of my account in metamask is not detected. The account box in remix remains always blank now (see picture below). Note that I ...
2
votes
1answer
55 views

function input conditional check

I have a function which is accepting a string argument as input parameter. This string is an IPFS hash and I would like to check that the input is actually just that and not a malicious link or the ...
0
votes
1answer
48 views

msg.sender 'spoofing' when function is public or external

I have a Smart contract where I want only the onwer to call a specific function, for example: function getInfo() view public onlyOwner() returns (address) { return msg.sender; } ..... modifier ...
1
vote
0answers
15 views

Understanding a simple online contract which seems not functional

I am writing to understand the functionality of this contract (https://etherscan.io/address/0x1f14b77e9f4844889fa63bc1e5180c8b90ec18db), this does not look even "functional" to me. Here is the ...
1
vote
0answers
28 views

What are the drawbacks of layer 2?

The scalability trilemma states that a blockchain can only have two out the following three properties: decentralization, scalability, and security. Layer 2 protocols aim to make Ethereum more ...
2
votes
0answers
67 views

Is there any dynamic symbolic execution tool for smart contract [duplicate]

There is a question (Security analysis tool for Ethereum smart contracts) similar to me, but it presents mostly static analysis tools. I'd like to know if there is any better dynamical analysis tool ...
1
vote
1answer
20 views

Is there any concern for the significant number of nodes being hosted on AWS/ cloud providers?

Just curious if there is any downside that many nodes are being hosted on cloud providers? For example Infura, which supports many nodes and provides a large portion of connections to Ethereum nodes, ...
0
votes
1answer
28 views

Is a function prone to re-entrancy attack even if I set balance to zero within the same function (example included)

Such as in this scenario, is the hackable via re-entrancy? thanks... function withdraw(uint256 money) public { if(money <= balance[msg.sender]) { (bool success, ) = msg.sender.call....
1
vote
1answer
100 views

What is the Withdrawal Pattern?

I am reading this article : https://medium.com/@jgm.orinoco/why-use-the-withdrawal-pattern-d5255921ca2a It seems interesting. Could anyone explain the idea of the Withdrawal pattern in a simple way ?
0
votes
1answer
15 views

How to prevent someone running a transaction before me?

Let's say I have the following in my smart contract: string passwordHash; uint money; function checkPassword(string cleanPassword, string newPasswordHash)[...] When running the function ...
1
vote
1answer
130 views

How to start auditing smart contract?

I want to become a smart contract auditor. I will report all the vulnerabilities which I have explored while auditing smart contracts. Is there any platform available to learn how to audit smart ...
0
votes
1answer
13 views

What is the authorization for any technical central action in Ethereum system?

When, after fully reviewing, pull requests management and a detailed discussions on github and so on, it arrives the moment in which someone must take into his hands the technical intervention on the ...
5
votes
1answer
83 views

How to jump to any arbitrary location in already deployed contracts

I’d like to know what is preventing me to write an assembly code who knows the contract address and call some arbitrary functions, even if declared “internal” via a simple JUMP. In theory I can: 1) ...
1
vote
1answer
127 views

Is signatures from web3.eth/personal.sign deterministic and a safe to be used as seeds for private keys?

The first part of the question: if I give the same inputs (content and signing address) to the web3.eth/personal.sign, am I correct to expect the signature generated to be the same no matter how many ...
1
vote
1answer
208 views

Does this function send ether from the contract or from the message sender?

Solidity newbie here...: function transfer(address payable to, address sender) public onlyadmin { to.transfer(msg.value); } what I want to achieve is sending from the contract's ...
0
votes
0answers
86 views

How to prevent DDOS in ethereum using PoA?

Using clique, how to prevent DDOS attack? Is there a way to set a whitelist of nodes which can send transactions, and blacklist all the others?
1
vote
3answers
368 views

How to store private data on blockchain to be readable from a contract?

I'm writting DApp on Ethereum (Solidity) and I need to find a solution how to store a private data on blockchain, when I also need to proceed them somehow. If it is only about storing, I can use some ...
3
votes
1answer
183 views

How secured are private data stored on blockchain?

I'm quite new in Ethereum world and I'm still little bit confused about this: If I store any data on blockchain, is it readable from anyone? Let's say I have this is Solidity: ... string private ...
0
votes
1answer
47 views

What is the beginning nonce on the Rinkeby Testnet?

I know that the nonce is representative of how many transfers an account has made and is 0 at the start on the mainnet. However, on testnets, such as the now decommissioned Morden where it was 2^20 I ...
1
vote
0answers
63 views

The blockchain trilemma

I understand that the generic blockchain faces a problem where it can choose to optimize between scalability, security and decentralization. I can see easily why scalability and decentralization are ...
2
votes
2answers
463 views

Getting ParserError: Expected ',' but got 'payable' and also one important security issue with contract

I have write a small smart contract for lottery system. however there is problem. please see below full code. pragma solidity >=0.4.22 <0.6.0; contract Lottery{ address[] public players; //...
1
vote
2answers
80 views

DappHub Multiply Function

Could someone explain the use of performing a multiplication such as this? I mean the logic is fine, but what is the importance from a security point of view? function mul(uint x, uint y) internal ...
6
votes
1answer
597 views

What does griefing mean?

Not referring to the definition in the dictionary. In the context of blockchains and Ethereum in particular, the term "grief" has been used repeatedly in a host of scenarios: ethresear.ch, Plasma ...
-1
votes
1answer
164 views

Trying to figure out this 2 ETH smart contract quiz

Does anyone know whether this smart contract can be broken? Is there some trick behind this? https://etherscan.io/address/0xfc62a32da21052fb3086e8f68ad10a7118a98606
1
vote
0answers
57 views

What possibly could go wrong if I leave my private blockchain node 30303 port open to public? [duplicate]

I have the following setup: All the nodes inside my cluster are talking to each other via 30303 port. When I want to talk to them, I'm using a Geth light client via HTTP JSON RPC port 8545. Only the ...