Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
0
votes
2answers
12 views

ERC-721 NFT how long can be metadata url string

I have three questions: what is the size limit for url field of ERC-721 NFT metadata. can that url be changed by some smart contract. can that url and token id be discovered/visible by over smart ...
0
votes
1answer
15 views

How would you prevent someone calling a public mint function?

Sorry if this question is silly, I'm still learning. My smart contract has a function which mints a token and is owned by the caller. I set it as public so it can be called externally through web3js. ...
0
votes
0answers
10 views

Authenticating tokenUri before minting?

i'm tinkering with a concept for NFT minting with generative music and art and trying to work out the best way to make sure that people can only mint essentially ‘approved’ content. I.e from the ...
1
vote
1answer
16 views

Where can i found advanced courses about blockchain security?

Where can i found advanced courses and walkthrough box like TryHackMe and HackTheBox, about blockchain security and Defi, ethical hacking with challenges todo to learn about it. Best regards
0
votes
0answers
24 views

publishing blocks with delay

this is rather a simple and fundamental question but nevertheless i couldn't find any solution for it and now I'm worried if it can cause real attacks to slow blockchains. imagine in a form of ...
0
votes
0answers
4 views

Secure Quorum nodekey of node into vault

The nodekey of ethereum node is exposed in the same place on quorum node's VM. is there any way to secure this nodekey into vault and then use it from there wherever needed?
1
vote
1answer
22 views

What do I need to be careful about when using block.timestamp?

I am using block.timestamp for some critical part of my code. What should I be aware of? What can miners do? Can they fake it? Delay it? Make it go back in time? If yes, what would it take them to do ...
2
votes
0answers
50 views

Ethernaut level 20 Denial probably no longer solvable. Why?

I solved all levels of Ethernaut game except level 20 Denial: https://ethernaut.openzeppelin.com/level/0xcE1BB92eeb71AF5Fec09D38B0c854d55285f6e04 Eventually, I gave up and looked up the solution on ...
0
votes
0answers
8 views

Is it cryptographically secure to encrypt messages using Ethereum EOA addresses?

I understand that it is possible to do this, and have messages decrypted by the private key of an Ethereum account, but I am wondering if it is cryptographically secure (or ideally, how secure) it is ...
0
votes
0answers
30 views

How do these 2 functions differ in terms of security?

How are these 2 functions different in terms of security, there was a question on a forum and i don't understand function emergencyWithdraw(uint256 _pid) public { PoolInfo storage pool = poolInfo[...
0
votes
2answers
34 views

Signing transaction on frontend and sending on backend server

Hi I'm making an NFT auction site similar to OpenSea to learn blockchain technology. But I have some security concerns about sending transactions on the frontend of my application because if a user ...
0
votes
1answer
17 views

Is there a way to filter token contracts based on whether they contain certain code?

Basically if I had a list of 500 token contracts instead of manually going and reading through each token contract, is there a quick and easy function (such as an RPC call method) that checks if the ...
0
votes
1answer
24 views

Using require(success) for a transaction call in a withdraw function, after emptying the callers saved amount of ether

In this contract: contract auction { address highestBidder; uint highestBid; mapping(address => uint) refunds; function bid() payable external { require(msg.value >= highestBid); if (...
0
votes
1answer
17 views

Is it possible to intercept a message sent to a smart contract (i.e. a guess for a quiz) and send it as your own before the original reaches it?

I'm trying to write a smart contract that can be generated by an individual given ETH/ERC-20 value to lock and a secret passphrase (hashed). Then, given that another individual sends the passphrase in ...
0
votes
2answers
46 views

Slither Tool Error On Contract That Inherit From Openzeppeling

Hey Guys Hi ALl ! *I'm trying to use SLITHER (analizy tool ) but when i try to use it on a contract what inherit from Openzeppelin it give me this error(photo) Error: Source "@openzeppelin/...
0
votes
1answer
14 views

What could be the problem if there is only one sealer in private network with PoA Consensus?

I have a private network created using geth and I want to use it as a decentralized database. Currently, I'm testing the network using 3 nodes which one of the nodes as a validator (hence only one ...
1
vote
2answers
32 views

Would there be a practical attack to this random generator function?

I'm generating a pseudorandom number using Solidity. I understand the deterministic nature of the blockchain and the necessity of using an oracle for a seed. That said, I'm selling randomized items ...
0
votes
1answer
22 views

How does this example of a race condition really happen?

I've come across an example of how a race condition can happen in a scenario like this that I don't understand how it could occur: Bob creates RaceCondition(100, token). Alice trusts RaceCondition ...
2
votes
2answers
31 views

Is it safe to use a signed public address signature as a password

So I am building a email/passwordless register and login function on my website and I want my users to use metamask to do so. So what I thought of doing was using the user public address, signing that ...
1
vote
1answer
33 views

Trying to understand front running "dark forest" solution

I just got the chance to read about the Dark Forest problem describing an actual front running attack: https://www.paradigm.xyz/2020/08/ethereum-is-a-dark-forest/ I didn't fully understand the ...
0
votes
0answers
18 views

Wierd exploit in auto-liquidity token

i dont know if this is a known exploit or not, but this caught my attention. It seems that address on mainnet is a contract (unverified of course) that takes advantage of a vulnerability somewhere ...
2
votes
1answer
32 views

What are the common ways to protect access to web3 provider?

Most dapps require an instance of web3 provider in the browser. It seems that it is often achieved by directly connecting to Infura or Alchemy node URL (for example, in WalletConnect docs: https://...
1
vote
0answers
98 views

How to recover all additional accounts belonging to a MetaMask seed phrase?

When we first create a MetaMask wallet, it has a seed phrase and there is only one wallet address. By pressing Add Account in MetaMask, however, we can also create additional wallet addresses ...
0
votes
1answer
50 views

How to tell If 2 Metamask wallets were created from the same seed phrase?

When you first create a MetaMask wallet, it is also possible to add on more wallet addresses by pressing Create Account, so that your MetaMask has Wallet #1, Wallet #2 and so on. All of these wallets ...
0
votes
0answers
19 views

Converting Ether to Monero vs using a tumbler

There are two ways to obfuscate source of funds, in this case Ether: Use a cryptocurrency tumbler, that mixes a source walet's contents into multiple parts that can be sent to a final exchange for ...
0
votes
0answers
23 views

will require( tx.origin == msg.sender ) block my function in the future (Ethereum upgrades)?

I am trying to use require( tx.origin == msg.sender ) in very specific functions such as transferOwnership and selfdestruct functions. This aims to make sure that the caller of this function is doing ...
0
votes
1answer
28 views

Is there a design pattern in order to protect private keys in a Multi SigWallet?

I've developed a MultiSig Wallet for my company. For timing reason i've used as "code base" the Ethereum Multi Sig Smart Contract by BitGo (here the link of the repository: https://github....
1
vote
1answer
39 views

What are the SECURITY CONSIDERATIONS when using INFURA to interact with the ETHEREUM mainnet?

What are the security considerations that should be noted when interacting via Infura to the Ethereum Mainnet? Are your private keys or mnemonic phrase ever sent to Infura? Can Infura execute any ...
0
votes
0answers
18 views

Any known hacks by storing string with non-alphanumeric values?

I was checking out hashmasks smart contracts, and they have the following rules for names: No name can be identical There is a limit of 25 symbols (including spaces) Uniqueness is case insensitive (i....
0
votes
0answers
74 views

How to prevent timeout on Solidity contract (not on tests or deployment config)

Consider the following function which is our current workaround to calculate the power of fractionals without overflowing (if you know a better one please let me know in the comments): function power(...
0
votes
0answers
22 views

ERC20 token security vulnerabilities

My goal is to make a simple inert ERC20 token. I copy and pasted a basic code from a tutorial I found on Youtube and it works on the testnet. I have two concerns: That the code might be incomplete/...
0
votes
1answer
32 views

How to make your token safer without => setTaxFeePercent(uint256 taxFee) external onlyOwner()

if I understand correctly, this line allows the owner to adjust the fee afterward, so in the worst case, a rugpull is possible. function setTaxFeePercent(uint256 taxFee) external onlyOwner() { ...
1
vote
0answers
36 views

admin.peers shows peer info (local and public ip). Is this cause for concern?

I'm connecting to a private blockchain network over the internet using geth. In the console of geth if you run admin.peers it lists both: local_address(internal ip) remote_address(external ip) I have ...
0
votes
1answer
14 views

Security considerations: using events to trigger offchain actions

I need to trigger a sensitive offchain action based on a users interaction with my smart contract. My current approach is to emit and event (Trigger(msg.sender, 123)) and then use a filterQuery with ...
1
vote
2answers
268 views

Is Solidity fundamentally flawed? [closed]

hacks of dapps are common. is it because most devs are idiots? is it because solidity is fundamentally hack-prone? would there be as much hacks if most dapps were written in vyper/glow-lang?
2
votes
1answer
119 views

How to interact with a smart contract without ABI

So I bought a scamcoin (I know). I have the contract and I've managed to decompile the bytecode. How can I interact with the contract to approve the token? https://bscscan.com/address/...
0
votes
1answer
61 views

Ether was stolen from my account - Why and how?

I was recently the victim of a hack consisting in withdrawing me all my wallet without being able to do anything. Basically someone paid me in ETH to my address (using my public key) and then a few ...
2
votes
1answer
456 views

Does exposing a MetaMask private key mean the seed phrase is compromised?

Say I have two MetaMask accounts generated from the same seed phrase. If I accidentally expose one account's private key, could an attacker reconstruct the wallet's seed phrase and therefore the other ...
1
vote
1answer
22 views

Is there a need of network additional security measure

I didn't find information about the risk and threat of being connected to the Ethereum network / internet. I was wondering if we would need additional measures such as a firewall, proxy to protect ...
4
votes
1answer
131 views

Why does OpenZeppelin implement increaseAllowance and decreaseAllowance functions differently in their ERC20 contract?

This is copied from their ERC20 contract from github (https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC20/ERC20.sol): function increaseAllowance(address spender, ...
1
vote
1answer
148 views

How secure is the seed phrase (12 words, 24 words)

The total number seed phrases are 1,329,227,995,784,920,000,000,000,000,000,000,000 - if I right counted - 12 words. Yes is very much, as seems. But let's regard - there is a thief and he wants to ...
0
votes
1answer
21 views

Fictitious use case to send confidential data

I am designing the network architecture of a Fictitious agency that needs to send confidential data. So my questions are: Is it possible to send images through the Ethereum network? I've read that, ...
6
votes
2answers
267 views

What is the point of the non-upgradability of Smart Contracts?

The title is clear: I do not clearly understand why a Smart Contract (SC) cannot be upgraded. Which is the problem of letting SCs being upgraded? Costs? Security? I imagine an scenario where some ...
1
vote
1answer
264 views

How to make this eth honeypot?

I am sure everyone must have seen this honeypot 0xb7605ddc0327406a7ac225b9de87865e22ac5927 Where the eth is automatically send to another parent address.. How can i make the same thing? For ...
0
votes
0answers
20 views

How to send ethers to specific address based on solidity contract but not web3py?

I have written a solidity code, running it on Remix and I use ganache and web3py library to interact with it. My code is something like this: contract simplePayment{ function sendPayment(...
0
votes
2answers
40 views

How safe are the view functions, can anyone see the data I am sending to a view?

I would like to create a contract that uses the view function, however, I must make sure that nobody can see what data I am sending to a view since it is a sensitive content. The contracts simply acts ...
1
vote
0answers
18 views

Solidity PRNG with future block hashes: reasonable secure?

I would like someone to tell me if I am neglecting serious security concerns here. I Am trying to create a Solidity slot machine where hash puzzles (leading zeros) are used to get various jackpots. ...
1
vote
0answers
41 views

What would be the cost for one to mine one of his own block?

Smart contract built countermeasures against flash loan attacks. But some of them are just requiring the money to come from an eoa and thus are at risk from peoples who own the funds for themselves. ...
1
vote
1answer
56 views

How can I demonstrate attacks on Quorum-based smart contracts in my local test network?

Currently, I am conducting a research regarding the security and privacy vulnerabilities of Quorum-based smart contracts. However, so far I've been struggling to implement attack vectors in order to ...
2
votes
1answer
126 views

Best way to lock tokens for investors vesting period

What would be the most convenient way for our team to lock tokens for a vesting period for a relatively large number of wallets? (30+) We've considered team.finance as well as writing our own contract ...

1
2 3 4 5
13