Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
0 votes
1 answer
15 views

Is there a recommended maximum size for an input array in a Solidity smart contract?

// SPDX-License-Identifier: MIT pragma solidity ^0.8.0; import "./interfaces/IERC20.sol"; contract Airdrop { function airdropToken( address _token, address[] calldata ...
user avatar
0 votes
0 answers
18 views

Is it gas efficient to call another contract's external function in a loop?

I am trying to create a staking protocols where rewards and staking are separate. But there are multiple tokens that get rewarded and I need to update each of them in a loop. Now, my question is how ...
user avatar
  • 363
1 vote
3 answers
30 views
+200

Is it possible for a callee to DOS a function call if the caller ignores the success value?

Consider the following function: uint256 mySpecialNumber = 0; function foo(address callee, uint256 newNumber) public { mySpecialNumber = newNumber; // make a low level call to the bar() function ...
user avatar
0 votes
2 answers
26 views

Are Chainlink keepers a security liability?

I've previously read some of Buterin's posts and he's been especially critical of cross-chain bridges. I know they aren't bridges where digital assets are stored non-natively, but are Chainlink ...
user avatar
  • 29
0 votes
1 answer
20 views

If it Safe to Expose Geth RPC to Public Internet

I just spun up a geth node on my home server with flags --http.addr=0.0.0.0 --http.vhosts=* --http.corsdomain=* --ws --ws.origins=* --ws.addr=0.0.0.0. I am using a nginx reverse proxy to make it ...
user avatar
0 votes
0 answers
9 views

Ethernaut #16 Preservation. Contract loaded from address in Remix fails to fully interact with contract. Strange bug

Ethernaut's Preservation is solved by exploiting that the delegate call to LibraryContract in setFirstTime() and setSecondTime() in fact changes the first variable in Preservation itself (not in ...
user avatar
  • 1
0 votes
0 answers
25 views

Can you prevent a `revert` from happening?

I was wondering if there is a way to avoid the revert statement in this code example. Or to put it another way, could you write a smart contract that allows arbitrary operations as long as you have a ...
user avatar
  • 452
0 votes
0 answers
19 views

Ethernaut #11 Elevator, Gas estimation failed

I'm trying to solve Ethernaut #11 Elevator. My solution works when I deploy a copy of the instance contract by myself on Remix VM, but when I try it on the real instance on the Rinkeby network, using ...
user avatar
  • 1
0 votes
1 answer
54 views

How to fix vulnerability in solidity contract

I have recently deployed a contract on the BSC mainnet that got drained of all the funds in it, but I can't seem to find where in my contract the loophole is to know how it got drained so it doesn't ...
user avatar
0 votes
0 answers
20 views

Security risks of calling the approve method of an ERC-20

Looking into the uniswap code of https://docs.uniswap.org/protocol/guides/providing-liquidity/the-full-contract: function increaseLiquidityCurrentRange( uint256 tokenId, uint256 amountAdd0, ...
user avatar
0 votes
1 answer
10 views

How to ensure the security of computation and transmition on Smart Contracts?

Suppose there is a smart contract with a bidding function, and the bidder can send the bid price to the smart contract after encrypting it. When the auction is over, a trusted third party sends the ...
user avatar
0 votes
0 answers
13 views

Decrypt a message on-chain with a perfect secrecy

Does anyone have a good solution to decrypt a message on-chain, with a perfect secrecy and/or with a weak/re-used key? I found a solution (CTR encryption mode) in a previous post but I don't ...
user avatar
0 votes
0 answers
12 views

How would ethereum migrate a whole transaction history after The Merge?

I have read press release of upcoming The Merge and face with promise to save a whole transaction history without tech details: No history is lost. As Mainnet gets merged with the Beacon Chain, it ...
user avatar
  • 259
0 votes
1 answer
31 views

Question about ethereum security

I want to ask a question. As far as I know, if we capture the majority of the nodes of the blockchain, we can get the control of it. In web3 terminology, our aim is to recover internet from big tech ...
user avatar
  • 1
0 votes
0 answers
43 views

Protect Infura ID from being stolen and abused

I'm using an Infura API key for my dApp's "Connect Wallet" integration with Web3Modal Key: Relevant Codebase: import Web3Modal from 'web3modal' import WalletConnect from '@walletconnect/...
user avatar
  • 101
1 vote
0 answers
13 views

Using veiw functions to overload Blockchain node

Question: What is stopping me from creating view function with heavy computation (infinite loop). Deploying it on Blockchain and then calling it just so I could overload a Blockchain node that ...
user avatar
  • 775
2 votes
1 answer
42 views

How to encode message using public key ETH address?

I want to send an encrypted message to a specific ETH address via the blockchain. Hello, my secret. Can I encrypt this message in the browser with the public key of the recipient's address? I ...
user avatar
  • 23
0 votes
0 answers
16 views

Why the function which cannot send ether still need nonReentrant()?

I have a look at the code of a smart contract at https://etherscan.io/address/0x101816545f6bd2b1076434b54383a1e633390a2e#code. And i found that it utilize the nonReentrant() modifier to protect some ...
user avatar
0 votes
1 answer
36 views

Clone a Smart Contract

I'm an artist trying to publish his own contract. I don't have solidarity knowledge, but I can read/understand codes in general. So I found this collection minted yesterday: https://etherscan.io/...
user avatar
0 votes
1 answer
40 views

Is this implementation of Openzeppelin's ECDSA module secure?

I am quite new to ECDSA signatures and the exact way they work. In an attempt to understand it better I have tried experimenting with it. I am trying to create an ERC20 mint function using ...
user avatar
0 votes
1 answer
21 views

i want to add restriction on the modification variable

i want to share my code and see if someone help me to understand if it's a good practice ? i would like to restrited the modification of the number. // SPDX-License-Identifier: MIT pragma solidity 0.8....
user avatar
1 vote
0 answers
9 views

Are there any security concers with using @truffle/hdwallet-provider?

The project I am working on asked if I would remove the usage of @truffle/hdwallet-provider from our project due to security concerns. (One of the previous team members had supposedly concluded it isn'...
user avatar
  • 775
1 vote
1 answer
27 views

is pull over push pattern recommended for erc20 withdrawal too?

I had a chance to read the pull over push pattern for transferring/withdrawing ethers, but i'm not sure if i need to apply this for erc20 transfers. i.e. function buy(uint256 _someId, uint256 _price)...
user avatar
0 votes
1 answer
52 views

Reentrancy Ethernaut Challenge

I have been trying to pass the Reentrancy attack challenge of Ethernaut. Hence, I am creating this issue to ask help from anybody who knows where is the problem coming from. First of all, here is the ...
user avatar
0 votes
0 answers
16 views

How to bypass the openzeppelin-contracts Address.sol check and "tx.origin == _caller"

I am trying to create a smart contract for to mint NFT and token for security purpose, but I often got stuck with the contract checking, does anyone know if I can bypass those checking?
user avatar
0 votes
0 answers
33 views

Make user withdraw tokens

As a best -and most secure- practice, how do you make an user to withdraw tokens from your contract, without them having to initiate the withdrawal procedure (aka calling a withdraw function), instead ...
user avatar
  • 327
0 votes
0 answers
21 views

Possibility of spoofing miners in Ethereum

Ethereum uses node IDs to identify nodes uniquely and to route traffic between nodes based on the node discovery protocol (https://github.com/ethereum/devp2p/blob/master/discv4.md) built on Kademlia-...
user avatar
  • 56
0 votes
0 answers
9 views

Permissioned networks vs Access Control in public networks

I've been working with both public and permissioned EVM networks the last years. Everybody is aware about the benefits of public networks in terms of security, community, solutions ecosystem, ...
user avatar
  • 705
1 vote
0 answers
17 views

Solhint "Explicitly mark all external contracts as trusted" - how to fix

From my smart contract I am emitting an event defined in the interface (that my contract inherits/implements). I keep getting solhint warning about "Explicitly mark all external contracts as ...
user avatar
0 votes
0 answers
20 views

Is it worth it to deeply understand the EVM to become a smart contract auditor?

I have a huge interest in becoming a smart contract auditor and wonder if it is worth the time to really learn how the EVM works? It seems like most if not all vulnerabilities I read about are because ...
user avatar
1 vote
1 answer
40 views

Invalid ENS name in Damn Vulnerable Defi (naive-receiver)

I'm trying to solve the Damn vulnerable Defi challenge's Level 2 - Naive Receiver. We have to drain the user's balance by exploiting the missing access control allowing anyone to be the borrower and ...
user avatar
0 votes
2 answers
10 views

Why there are people who want to have multi-accounts in Ethereum?

Why there are people who want to have multi-accounts in Ethereum? I notice that in the Ethereum ecosystem, more and more people own more than one account, what motivates them to create more than one ...
user avatar
0 votes
1 answer
41 views

VsCode + Solidity 0.8, still underflow

I am running this contract on VsCode + Solidity 0.8.13: // SPDX-License-Identifier: MIT pragma solidity ^0.8.13; import "hardhat/console.sol"; contract Token { mapping(address => ...
user avatar
1 vote
2 answers
25 views

Is the key generated below valid and cryptographically secure?

For some reason, my React Native 0.68.0 app needs to generate private key for the Ethers wallet providing accessing to crypto.getRandomValues. The crypto.getRandomValues is polyfilled by react-native-...
user avatar
0 votes
2 answers
17 views

Encryption or hashing with data

The data which we send via Ethereum blockchain , is it ecrypted and sent to sender only & never stored on blockchain OR is it hashed ? Hashing is a one way process . It means that the data once ...
user avatar
0 votes
0 answers
28 views

Need some feedback on my NFT smart contract. Trying to ensure it's 100% donatable

My goal is to create an NFT Project that 100% of the mint proceeds are automatically donated to a select number of whitelisted addresses. Just would like someone to take a look and make sure I'm doing ...
user avatar
  • 101
0 votes
0 answers
49 views

Having trouble using Slither with big contracts with lots of imports

I am trying to learn smart contract auditing and Slither seemed like a good tool to use to catch low hanging fruit or point to potential bugs. However, no matter what I do I cannot get it to work with ...
user avatar
0 votes
0 answers
14 views

How to be able to generate new addresses for my users but avoid having to keep private keys on a server?

I'll have a service where users will deposit funds. How would be able to generate new addresses for my users but yet avoid having to keep private keys on a server? I could pre-generate them locally on ...
user avatar
0 votes
1 answer
35 views

Which type of operations are not confiables to be made on-chain?

I already saw a bunch of people talking that some operations are not safe to be made on-chain so it's better to receive this information as a function parameter from an off-chain source, but I did not ...
user avatar
0 votes
0 answers
13 views

can someone skip threw my contract and let me know if i have any faults

i would appreciate any feedback, i will be adding reentrancy guard aswell but if there is any obvious improvements please let me know. This is still a work in progress ! // SPDX-License-Identifier: ...
user avatar
1 vote
1 answer
41 views

What is MetaMask's security model?

Does it download block headers, like a Bitcoin SPV wallet? Or does it rely on a service like Infura to provide an API that it trusts to tell it what it holds? If the latter, could the service lie ...
user avatar
0 votes
0 answers
37 views

Any security issues with allowing a DApp access to "signing keys"?

Want to use mirror.xyz, but the DApp does not let you do anything without singing the following message in your wallet: I authorize publishing on mirror.xyz from this device using: {"crv":&...
user avatar
  • 165
0 votes
0 answers
18 views

Why this DAO attack doesn't work as expected?

For a course I'm taking we've written a smart contract that is vulnerable to recursive calls. pragma solidity ^0.4.24; contract Fundraiser { mapping(address=>uint) balances; constructor() ...
user avatar
0 votes
0 answers
11 views

What are Metaverse developers' security concerns?

this is my first post in EthereumSE, I would appreciate you in advance fr your kind welcome and helpful answers and comments. As a simple search shows, Metaverse is using Blockchain infrastructure. AR ...
user avatar
  • 103
0 votes
1 answer
50 views

Is it possible to make certain fields of a structure only available to contract owner?

For example, given the following structure, I want some fields to be visible only for the contract owner struct Participant{ address participantAddress; // can be seen by anyone string team; //...
user avatar
0 votes
1 answer
17 views

Could anyone experienced tell me if i have any obvious flaws in my smart contract please

I am very new to solidity, i have been playing around for about a week now and have created my first "good" bit of code i want to turn into a dapp. I would just like to see from a experts ...
user avatar
0 votes
1 answer
175 views

Security of Solidity versus Rust

I recently started learning Solidity, and I am interested in security aspects. Today, I encountered a very interesting blog article discussing security vulnerability in Rust. At my level of ...
user avatar
  • 3
0 votes
0 answers
58 views

Handling encryption of data in smart contract based app (specific scenario)

Small heads up, I'm a complete beginner, so many concepts are still unclear for me. Please correct me at any point if I'm talking nonsense. My question is how should data stored in a smart contract be ...
user avatar
0 votes
0 answers
46 views

Should I not use re-entrancy guard if multiple people might be calling the function at same time?

I went through the openzeppelin's implementation of re-entrancy guard. https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/security/ReentrancyGuard.sol I find the state ...
user avatar
  • 62
0 votes
1 answer
42 views

Who can edit an existing smart contract?

Is there any mechanism that limits the possibility of deploying a new version of existing smart contract so that only its author can do it? Or a mechanism which indicates that smart contract A is a ...
user avatar

1
2 3 4 5
16