Questions tagged [security]
Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.
831
questions
0
votes
2
answers
35
views
ERC20 token smart contract check
I wrote a ERC20 token smart contract that I did not find any problems in my tests and reviews, honestly, I would like you to help me check this code and tell me its possible problems in terms of ...
- 51
0
votes
1
answer
20
views
Use offchain date time
in my contract, I need to do something based on time, and this is quite sensitive, and as we know, you cannot rely on the block.timestamp because it can be changed, I want to know if there is a way ...
- 375
0
votes
1
answer
17
views
Is it secure to use multiple admin
im trying to do multiple admin system in my solidity and here is example
//SPDX-License-Identif`ier: MIT
pragma solidity 0.8.15;
import "@openzeppelin/contracts/access/Ownable.sol";
...
1
vote
1
answer
30
views
Building Cryptocurrency Tracking system for monitoring stolen cryptocurrency transactions
When hackers steal tokens from an account, what they generally do is divert the flow of tokens via multiple proxy accounts making it complicated for the cyber-forensics department to track final ...
1
vote
0
answers
19
views
How to run a script which requires a private key completely in a browser?
For a non-technical person I need to create a page on my website, in the admin area, in which he'd regularly do stuff that normally is done on local machine only. That is, a person doesn't want to go ...
- 49
0
votes
0
answers
17
views
Connect & interact with dApp without wallet connection
I have a question regarding the issues I am facing on my current project. I am building NFT marketplace on the Polygon network.
The specific requirement is we should allow the users can interact with ...
- 13
0
votes
2
answers
27
views
What are the best up-to-date secure approaches of generating pseudorandom number in Solidity? [duplicate]
I am thinking about creating a lottery with more than one winner and one round for users. Please don't consider usual 'commit-reveal' scheme. However, person can claim rewards on their own at the end ...
- 13
0
votes
1
answer
26
views
What is an re-entrancy attack and how does it work?
With the recent exploit on the omnipools on Conic Finance. The hacker used an exploit called: re-entrancy attack. How does it work explained in layman terms?
And what should smart contract auditors ...
- 4,760
1
vote
1
answer
92
views
What are the possible security threats when using mappings in Solidity?
Does the use of a nested mapping possess any threats to the security of the contract below?
contract Users {
struct User {
address payable regAddress;
uint64 timestamp;
...
- 202
1
vote
0
answers
24
views
How to prevent replay attacks on ZK Proof Transactions?
Alice wants to prove a statement (let's say, she has a secret value x such that x * 2 = 10) to Bob without revealing x).
Alice generates a proof using the ZK-Snark protocol.
const { proof, ...
- 296
1
vote
2
answers
139
views
Which of <= and < comparison operators use less gas in Solidity?
if(num <= 10) revert();
And
if(num < 11) revert();
Which of these statements consume less gas?
If we could save gas, we need not use less than/greater than equal to. We can just use less than ...
0
votes
1
answer
89
views
My coins were sent from my metamask wallet to another wallet without my consent
I just claimed tokens after a presale had ended from the token site to my metamask wallet. That transaction was successful. However, just one minute after that transaction took place, my coins were ...
0
votes
1
answer
38
views
Another contract is intercepting my contract calls and stealing the funds, what can it be?
This is the code I have, and I deployed to polygon mainnet to test. https://polygonscan.com/address/0x3CC3F39cc2386a8847378F4022917B3bB623BAFD
// SPDX-License-Identifier: MIT
// An example of a ...
- 1
1
vote
1
answer
43
views
Can `msg.value` be trusted to remain the same after an external call?
Can msg.value be trusted to remain the same after the weth.deposit call in the foo function?
pragma solidity >=0.8.19;
interface WETHLike {
function balanceOf(address account) external view ...
- 16.8k
2
votes
1
answer
78
views
QuickAlerts Help!
I have been using QuickAlerts to track activities on my smart contract and receive a WebHook in my Discord server. How can I make sure that the WebHook is indeed coming from QuickAlerts and not a ...
- 193
0
votes
1
answer
47
views
Is it possible to do two-factor verification (email, text, let's say) using ethereum?
One of the values of a trusted, centralized authority is that it can use two-factor authentication to establish a permission to do a given action.
Is it known whether an ethereum smart contract can ...
- 103
0
votes
1
answer
82
views
Can't reproduce reentrancy if the smart contract has >= 19 ether in remix
I'm trying to understand reentrancy in solidity.
I took the example from https://solidity-by-example.org/hacks/re-entrancy/.\
You can also take the original one if you want, the result is the same.
...
- 3
1
vote
1
answer
32
views
What does it mean by "rollups sends transactions on mainnet"?
While trying to understand what rollups are, I read rollups sends transactions to mainnet in a batch. I don't understand why and practically what does it do.
To better understand it, I came up with a ...
- 206
0
votes
0
answers
16
views
How to improve the performance of a smart contract and secure it
I wrote a simple contract that exchanges the ERC 20 token for USDT, how can this code be improved in performance and what flaws or vulnerabilities it has
// SPDX-License-Identifier: AGPL-3.0
pragma ...
- 127
0
votes
1
answer
256
views
Detecting scam tokens on bsc pancakeswap
Certain contracts cannot be sold after buying on pancake swap apparently because they have code that makes that so.
This is one example:
0x6d041ae2494641c229e9e348616f40bf390aa3f8
How is it that token ...
- 135
1
vote
2
answers
32
views
Ways to earn ETH passive income
I have a decent amount of ETH in my cold wallet (<32 ETH). These bag of ETH is my HODL bag, meaning that I don't want to spend it and I am planning to hold it for the next 10-20 years.
What are my ...
- 11
0
votes
1
answer
28
views
Identifying a Reentrancy Attack Vulnerability
Can this function be subject to a reentrancy attack? Are there simple code smells for identifying them?
function collect() external {
payable(owner()).call{value: address(this).balance}(&...
- 123
0
votes
0
answers
20
views
does empty function has security risks?
I have to implement the following interface in my contract
interface IMetadataRenderer {
function tokenURI(uint256) external view returns (string memory);
function contractURI() external view ...
0
votes
1
answer
125
views
When should I use ReentrancyGuard in a smart contract?
I am looking at the ReentrancyGuard smart contract from Open Zeppelin and I don't understand when I have to use it.
Is it necessary in all my smart contracts or do I only have to add it in some ...
- 631
0
votes
1
answer
127
views
Constructor arguments from EVM bytecode
I have a contract that results to the following bytecode: ...
0
votes
0
answers
15
views
is EnQlave by QRL for post quantum Etheerum dependent on QRL Blockchain?
EnQlave is an initiative by QRL to secure Ethereum blockchain against quantum attacks. What QRL people claim is that the EnQlave wallet will not be dependent on any other blockchain other than ...
1
vote
1
answer
25
views
What is a good use case for .call functions' ability to pass a function call?
Following up on this thread, I wish to understand what will be a good use case using the feature to call a function in .call{}() ?
1
vote
1
answer
28
views
storing and retrieving data in Solidity
in another solidity study, I want to implement a contract to store user links. users must log in using the wallet address and be able to save data by name, description, type, and the link itself. ...
- 127
2
votes
1
answer
94
views
Security and Performance of Solidity Contract
I continue to explore solidity. I wrote a small distributor contract that collects ETH from incoming transactions, records the addresses of incoming transactions with a given condition, and ...
- 127
2
votes
1
answer
152
views
Is my Smart Contract Secure and Optimized properly?
how safe is this code and is it possible to optimize it
// SPDX-License-Identifier: AGPL
pragma solidity ^0.8.17;
interface IBEP20 {
function transfer(address to, uint256 value) external returns ...
- 127
1
vote
1
answer
248
views
Fake BUSD transcation sent from my wallet (not fake 0 token scam)!
Transaction Hash: 0x7800fb4d9345fc7e8b2794a479f414948eb1a9126e14daff11d1802440996a68
The hackers sent fake busd token (with >0 amount) from multiple victims wallet to another wallet without any ...
- 11
0
votes
1
answer
45
views
Error: Expected string literal (path), "*" or alias list
I m currently working on smart contracts and i m trying test the contracts i wrote. I am using smartbugs tool. So far, i have executed the following commands in the powershell,
git clone https://...
0
votes
1
answer
38
views
Can i use oyente Tool on windows?
I am currently working with smart contracts. I want to perform security analysis on the smart contracts I developed. I tried using Oyente Tool and Docker in my Windows 10 Home system. But I can only ...
2
votes
1
answer
64
views
How can ERC20 tokens be obtained in a local hardaht forked environment?
I've been learning about ethereum for a short time, besides my English could be better; if I'm wrong about something, please correct me. 😁 I am trying to test the interaction of different contract ...
- 21
0
votes
0
answers
7
views
What is smart contract re-entrance vulnerability?
What is re-entrance vulnerability? How can I prevent a smart contract from being re-entrant? What are some common vulnerabilities to watch out for?
- 519
1
vote
0
answers
68
views
How to pass web3 client from server to client in next.js?
I spent all day (meh, not a record (but I'm not finished yet lol)) trying to pass the web3 instance to the client side of my app. Why would I use it on the server side? Well, to keep my wallet ...
- 49
3
votes
0
answers
16
views
Ethereum sharding minimum committee size of 111 for safety
I am currently researching the minimum committee size required for Ethereum sharding. According to Vitalik, the minimum number of validators in a committee associated with a malicious committee ...
1
vote
1
answer
33
views
Can an encrypted message be safely revealed
In this demo Alice is using Bob's public key to sign a message that only the Bob can decrypt. Is it safe for Bob to reveal this decrypted message, or would that allow an attacker to determine his ...
- 133
0
votes
1
answer
67
views
Why is dangerous to share metamask logs?
Sorry for the noob question, but if the Metamask logs don't contain a secret phrase, why is it dangerous to share it online?
Also, can hackers get hold of my Metamask wallet logs without hacking my ...
- 1
2
votes
1
answer
237
views
Best way to store private data in smart contract
I wanna to store some personal data as a string to my smart contract with simple store function like a note:
mapping (address => string[]) private addressToNotes;
function store (string memory ...
- 350
2
votes
2
answers
898
views
NEED help - MEV bots attacking our liquidity pools - how to counter or block the MEV bots?
Intro
We have 2 tokens in our project and 3 liquidity pools ( "token1-ETH", "token2-ETH" & "token1-token2"). Token1 has ~5% of fees and includes reflection. Token2 ...
- 43
0
votes
0
answers
8
views
Can logging into your etherscan or signing into google through web3 dapp browser be a mistake?
Let's say an inexperienced user logs into their Google account through the ol "trustbitmask" wallets browser to get random things like email passwords etc. So they can log on to their ...
0
votes
1
answer
27
views
Is it 100% guaranteed that a process that listens to blockchain events will receive them if they get emitted?
When a smart contract emits an event, if I am listening to them for example with an application that stores all events from that smart contract into a database, do I have the certainty that I won't ...
- 631
1
vote
1
answer
57
views
What happens if 51% of validators in an epoch vote for an invalid block
Hypothesis
Full nodes that run both valid execution client and consensus-client would end up in a sort of deadlock and stop syncing. The consensus-client would try to feed the execution client with a ...
- 156
0
votes
1
answer
101
views
Restricting Access to Solidity Callback Function
I have a solidity contract that executes arbitrage trades with flash loans. In order for the flash loan pool to call the contract callback function after transfering the funds to my contract, that ...
- 157
1
vote
0
answers
223
views
My Goerli wallet has been drained
I want to open this question from overflow since it was closed and I experience the same problem.
This account "0x87C02eeacB08c11aFBb821798DB2F4cCcd8F9E3d" has been stealing many goerli and ...
- 11
0
votes
0
answers
21
views
Differentiate a real and counterfeit NFT with the same name and symbol
Regarding this "We also remind everyone that any smart contract can use the same name and symbol as your contract.", then how do users identify a real and a counterfeit NFT series? If I ...
- 1
2
votes
1
answer
38
views
Why optimistic rollup chains can take a week, while ZK don't?
Optimistic and ZK rollups, both submit data to Ethereum or similar chain, but why do optimistic rollups take longer time then zk rollups? What's the core difference that causes this time difference?
- 601
0
votes
0
answers
19
views
Why do optimistic rollups take 1 week to transfer data between blockchains?
There are 2 types of layer 2 rollups basically: optimistic rollups and zk-rollups.
Why do optimistic rollups take 1 week, and zk-rollups take a few minutes. I don't understood that part.
- 601
1
vote
1
answer
26
views
Whata are the differences between Ethereum and Ethereum Classic?
What are the key differences between Ethereum and Ethereum Classic and what implications do they have for the future of the Ethereum network?
- 139