Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

0
votes
0answers
7 views

Mythril not Installing when I do pip3 install mythril. Showing errors

Could not fetch URL https://pypi.python.org/simple/mythril/: There was a problem confirming the ssl certificate: [SSL: TLSV1_ALERT_PROTOCOL_VERSION] tlsv1 alert protocol version (_ssl.c:645) - ...
1
vote
2answers
68 views

DappHub Multiply Function

Could someone explain the use of performing a multiplication such as this? I mean the logic is fine, but what is the importance from a security point of view? function mul(uint x, uint y) internal ...
5
votes
2answers
335 views

What does griefing mean?

Not referring to the definition in the dictionary. In the context of blockchains and Ethereum in particular, the term "grief" has been used repeatedly in a host of scenarios: ethresear.ch, Plasma ...
-1
votes
1answer
71 views

Trying to figure out this 2 ETH smart contract quiz

Does anyone know whether this smart contract can be broken? Is there some trick behind this? https://etherscan.io/address/0xfc62a32da21052fb3086e8f68ad10a7118a98606
1
vote
0answers
34 views

What possibly could go wrong if I leave my private blockchain node 30303 port open to public? [duplicate]

I have the following setup: All the nodes inside my cluster are talking to each other via 30303 port. When I want to talk to them, I'm using a Geth light client via HTTP JSON RPC port 8545. Only the ...
2
votes
1answer
41 views

How privacy can be ensured in smart-contracts?

When a smart-contract is created following an agreement between two entities, how the state of that contract (data) can be kept secret to only the two contractors? I heard about Quorum, but how ...
1
vote
0answers
28 views

Is there a more elegant way to do an aggressive multi-send?

I understand there are many approaches to do multisend but for me timing is a priority and I do not want to stop the transaction if a address.send fails. function multiSend() internal isAdmin { ...
1
vote
0answers
18 views

secure open source Payment Gateway [closed]

I'm working on an open source multi coin payment gateway. ETH, EOS, BTC and BCH will be supported. My plan so far: The nodejs API runs on DigitalOcean. You send a GET request with your preferred ...
1
vote
0answers
32 views

GETH accounts imported without my knowledge

I expose only port 30303, not 8545. But when I issue commands eth.accounts. I found these accounts were imported without my knowledge: "0xe4fe1fb7e693c529f5a95dd8b1714d1acfdbd058", "...
1
vote
1answer
30 views

Cannot send transactions

I have a online shop where users can recieve ETH and do shopping. So to have a secure wallet, I have created an offline service which generates xpub and xpriv which I use to generate addresses in my ...
1
vote
1answer
28 views

Provide security wallet

I have a service where users can buy my product. Besides paying by card, I want to be able to allow users to pay in ETH. I think that it will correctly generate addresses for each user so that it is ...
0
votes
1answer
26 views

Invoking smart contracts

how can i restrict my smart contract getting invoked by any account in the network.can i tell the EVM itself to check(validate the account) is allowed to invoke the smart contract even before entering ...
0
votes
1answer
6 views

The DAO: Stalker Attack - Attacker split from childDAO?

I had a question about the argument in this article Why The Stalker Attack is a Non Issue. In the scenario the article describes, there is a "Victim" and an "Attacker". The Victim tries to split from ...
0
votes
1answer
26 views

Is this function good enough to refund ether or this security flaw?

I mean: function refund() { if (msg.value < 1 ether) { msg.sender.send(msg.value); return; } I'm probably wrong but this looks as if .send will drain the money in the contract if ...
0
votes
0answers
14 views

Is there a way to get back our lost/hacked/forgotten private key? [duplicate]

Now a days,if I am not wrong, everything is being clubbed with the private key and it is the user's responsibility to protect and securely keep his/her private key? So what if the user loses/forgets ...
0
votes
1answer
28 views

Is my function prone to under/overflow?

I don't like using safemath as this is my first conntract and this is getting a bit complicated for me so: function withdraw(uint xyz) public { require(balanceOf[msg.sender] >= xyz); ...
1
vote
1answer
37 views

account nonce - what if it did not exist? [duplicate]

I can't understand how account nonce actually avoids double spending. Every answer about this on the internet follow the pattern "If you only have 50 Eth and try to send 50 to A and 50 to B with ...
1
vote
1answer
21 views

Is attaching a name to an Ethereum address a “faux pas?”

I'm currently working on a DApp right now, and I was curious if it's considered poor design to include a string with the user's name that is mapped to a particular address. A user who has access to ...
0
votes
4answers
459 views

Generating lots of private key means I can hack someone's ether?

If I generates lots of private keys, I can get someone's address and its digital signature, right? I know that there's 2^256 possible private keys, but what if I use brute-force attack? Is it ...
4
votes
2answers
115 views

How is the keccak256(a, b) function implemented?

I need to understand how keccak256(a, b) is implemented and how it differs from keccak256(a || b). Is the content padded? I need this because I do not want to allow for vulnerabilities where a user ...
2
votes
3answers
213 views

how to easily transfer ERC20 token from 1000+ accounts which has no ETH in it initially?

I have a requirement to have 1000+ ethereum addresses, which in fact used to store small amounts of various ERC20 tokens. I want to move all these crypto assets in all these 1000+ wallets into a ...
1
vote
1answer
35 views

Can emitting an event after a state change cause a reentrancy attack vulnerability?

Is the following function vulnerable to a reentrancy attack? function withdraw() public { uint amount = pendingWithdrawals[msg.sender]; // Remember to zero the pending refund before // ...
1
vote
1answer
42 views

Smart contract consensus - underpinned by transactions?

I can easily visualise how consensus can be reached on transactions in systems such as Bitcoin, but I struggle to understand how consensus can work in a smart contract platform - i.e how can nodes ...
1
vote
1answer
48 views

Prevent other mining softwares to mine my public forked Ethereum chain

I forked an Ethereum chain and put it as public, but I only want my own software/client to be able to mine. Other miners using ethminer, geth, etc, cannot mine and profit from my chain (At least not ...
3
votes
0answers
34 views

Storing Private Keys in IoT Devices

In a network of IoT devices like internet-connected Raspberry Pis which sends transactions to the Ethereum blockchain, the Pis need to be able to access their own Ethereum private keys in order to ...
1
vote
1answer
23 views

Access manager in Smart Contract

I'm building a service where one can publish a crypted file on the internet which can be accessed and decrypted by people allowed. I don't want to store any crypted key on a server or something. For ...
0
votes
2answers
67 views

Solidity Checks-Effects-Interactions Pattern

From the solidity docs: Use the Checks-Effects-Interactions Pattern Most functions will first perform some checks (who called the function, are the arguments in range, did they send enough Ether, ...
0
votes
1answer
78 views

Delegated Proof of Stake (DPOS) vs. Proo of Stake? [closed]

What is the main difference between Delegated Proof of Stake (DPOS) vs. Proof of Stake? Is there any significant advantage for security? (since PoS in general suffers security problems.) And which ...
0
votes
1answer
224 views

How secure is using port 8545 from the internet (aka via JSON), can someone steal my ether?

Just noticed I can access 8545 from localhost but fortunately not from the web/internet. Do I need this at all? e.q. I read about someone who had lost $20 million due to someone else sending a call ...
1
vote
0answers
24 views

MIME types in Ethereum

Yesterday evening, an individual(at a french meetup haha) asked me what ethereum was and kept asking me if there was something similar to MIME types on Ethereum. I did not know what MIME types were ...
0
votes
1answer
88 views

Race condition in Ethereum

If I have several transactions in the same function, can I be sure that they will be executed one just after the other. Example with a dummy code: Contract store { constructor() public returns(...
1
vote
1answer
44 views

Trustless Inter-chain transaction with Bitcoin- are there any flaws?

Let's say that Alice wants to send Bob 1 BTC, and in return Bob will send Alice 1 ETH. Alice's Bitcoin address is BTC_A, and Alice's Ethereum address is ETH_A. Likewise, Bob owns addresses BTC_B and ...
1
vote
1answer
100 views

How to hide/protect smart contract arguments

In Ethernaut level 8 you are given this contract to hack: pragma solidity ^0.4.18; contract Vault { bool public locked; bytes32 private password; function Vault(bytes32 _password) public { ...
0
votes
0answers
37 views

geth/web3 integration with hardware security modules (HSM) before signing transactions/data

Is there some way to have web3/geth nodes integrate with hardware security modules (HSM) where a transaction request will first go to the HSM to fetch private keys before signing transactions/data?
0
votes
1answer
30 views

Is transaction triggered by web3 secure on the internet?

I'm trying to construct my business architecture using ethereum. I'll operate public ethereum node and private business server on the AWS. I'll trigger transaction from the private business server ...
0
votes
1answer
58 views

Using Hardware Security Modules to generate and store private keys on private ethereum / quorum

For a private ethereum networks, has anyone used Hardware Security Modules (HSM) to generate and store Ethereum private keys? I am keen to know how public/private keys are managed without a PKI (...
0
votes
0answers
13 views

Why is it important to defend a contract against reentrancy? [duplicate]

As stated. I have seen a number of threads about the how-to's on guarding a contract against re-entrancy. But in terms of best practices, security and risk-avoidance, WHY is it important to do so? (...
0
votes
1answer
52 views

Security Implications of allowing remote RPC connections to Geth Node

What are the security Implications of allowing remote RPC connections to Geth Node? If one absolutely needs to allow remote rpc connections for web3 connection, how can one do this while securing the ...
1
vote
1answer
279 views

How does the exploit in FOMO3D work?

With the recent release of the FOMO3D exploit in its smart contract, how does the exploit work?
0
votes
1answer
134 views

Solidity SafeMath library best practice use cases

I understand why and how to use the SafeMath library. However, I was wondering if there is a kind of best practice guide how and when to use the library and in which cases you don't have to. From a ...
0
votes
0answers
25 views

Storing generated accounts. Security

I originally built a system that had a front end where users simply entered some details and a password which then generated them a wallet and emailed it to them. My aim was that the user could then ...
0
votes
1answer
63 views

Detecting whether a transaction was cancelled (because a block is orphaned)

I'm writing a system where some transactions have to be automatically detected, and wait for 30 blocks to ensure they're confirmed. What I do is that I read all new blocks, and find the transactions ...
0
votes
1answer
117 views

Solidity - Shuffle address[] Index

Hello World ! I'm trying to find a way to shuffle an array of addresses in Solidity ! Looking at Underscore / Lodash source code _.shuffle() points out a few things. _.shuffle([1, 2, 3, 4]); * // ...
3
votes
0answers
69 views

Parity create testing transactions and blocks

For test purposes, I would like to make test blocks including test transactions against main net. For example I would like to make a transaction that sends one ether from 0x1234567... to 0x99999999......
2
votes
1answer
207 views

Keeping private key for signing transactions on a local server

Need an idea for not storing private key to sign transactions (on public server/database file system). The private key is needed to sign the transactions for transfer function ERC20 standard. To ...
0
votes
1answer
32 views

What kind of security measures do Testnets have in place?

Cryptographic work is spent verifying transactions on Ethereum, without which, there would be little to nothing preventing colluding to start a 51% attack or creating false identities to start a Sybil ...
0
votes
1answer
46 views

Quorum Consensus - BAR (Byzantine Altruistic Rational) Fault Tolerance / BAR Fault Tolerance / BAR Model

I refer to http://www.cs.utexas.edu/~dahlin/projects/bft/ http://www.cs.cornell.edu/lorenzo/papers/sosp05.pdf http://www.cs.northwestern.edu/~fabianb/classes/cs-443-w07/BAR.pdf https://blog.ethereum....
0
votes
1answer
199 views

Division/Percentages in Solidity (a workaround)

Division/percentages is a required part of many applications but is difficult to implement since fixed and ufixed are not supported yet in Solidity. I've come up with this workaround: pragma ...
0
votes
1answer
72 views

Whether Geth is safe to install?

I'm using Windows OS and is my private computer. Norton Internet Security says : Firewall rules were automatically created for geth and Intrusion Prevention is monitoring network traffic. Can ...
1
vote
3answers
1k views

How to generate multiple eth-addresses from one private key? [duplicate]

Is it possible to generate different multiple eth-addresses from one private key? The goal is to implement a JavaScript service that will allow a user to buy a subscription using cryptocurrency. ...