Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
0
votes
1answer
17 views

Does stack persist through external calls?

Looking through the docs I found that a malicious caller can take the stack depth to ~1000 and then make a call which would fail due to stack depth. Based on that let's assume that stack indeed ...
0
votes
0answers
4 views

What does "The Ethstick contract does not use extended precision" mean?

I'm reading mastering ethereum, and quote: The Ethstick contract does not use extended precision; however, it deals with wei. So, this contract will have issues of rounding, but only at the wei level ...
0
votes
1answer
10 views

Where can I find the security enhancement of solc compiler?

I came from this link, and quote It is highly encouraged to use Solidity v0.7.0 or newer. If you want to use a version of the 0.6 series, please make sure to not make use of flaws that have been ...
0
votes
0answers
14 views

SWC-126 Insuffixient Gas Griefing attack: why not simply requiring a successfull sub-call?

I'm trying to learn more about the SWC Smart Contract Weakness Classification and Test Cases. I'm stuck on understanding SWC-126: https://swcregistry.io/docs/SWC-126. Especially, I don't understand ...
0
votes
2answers
37 views

How to do the payment of royalties for a NFT marketplace transaction?

I have read the EIP-2891, but I don't know what is the correct way to approach the payment when the transaction occurs. Initially I thought of doing something like this: (...) // Transfer ...
0
votes
0answers
18 views

Can an attacker read value of a private variable? [duplicate]

Suppose, that I want to store and manage some confidential information with a smart contract. Also suppose, that everyone knows the source code and the address of the following contract: // SPDX-...
0
votes
0answers
22 views

How can a DEX protect itself against flash loan attacks?

How can a DEX protect itself against flash loan attacks? I've seen this code inside a function: require(msg.sender == tx.origin, "probably a flash loan tx") Is it effective? Are there other ...
1
vote
1answer
31 views

When using web3.js/Metamask on your website - how can you trust the data coming from your users?

So let's say your user sends a transaction, your script gets the receipt (getTransactionReceipt), checks if everything is fine and then does something. Can't people just rewrite your scripts in ...
0
votes
1answer
20 views

Store PrivateKey in webapp to send in transaction

I have a big question regarding the security of my system. Well, what happens.. I developed my contract using ECDSA, that is, it is only possible to do actions in my contract if the transaction is ...
0
votes
1answer
24 views

How much damage could result from a user wallet interacting with a malicious smart contract without approving token allowance first

Let's assume that a user found themselves interacting with a malicious smart contract, either in the form of a custom smart contract or as a malicious ERC20 or ERC721 token that was sent to their ...
0
votes
0answers
15 views

Managing private keys used to sign server-side transactions in decentralized apps

What are the best practices for managing private keys used to sign server-side transactions in decentralized apps? Currently, we're testing a dapp with the private key exposed as an environment ...
1
vote
1answer
12 views

urgent: dapp wallet connect security issue

i just attempted to connect metamask wallet to dappshubconnect using my 12-word phrase. a qr code appeared and i sent it to someone posing as support for a project i'm invested in. How high is my risk ...
0
votes
1answer
24 views

Is there a way to check a smart contract type in Solidity?

I'm new to Solidity, and I am focused on learning to write secure code. Is there a way to check a smart contract variable for its type? If I have the following function: function setNewToken(address ...
0
votes
0answers
14 views

can hacker hack all adress accounts in the same metamask wallet by one sub account's private key [duplicate]

the private key of one sub account of my metamask wallet is exposed on the web (github), I try to avoid to use this sub account, can hacker still get acess to other sub accounts in the wallet?
1
vote
1answer
85 views

What are the Pros and Cons of Managing Private Keys Directly vs Wallet Extension?

I would like to develop an app on an EVM compatible L1, however MetaMask currently does not have it on its list of supported networks. Hence the only alternative I can think off would be to manage ...
0
votes
0answers
74 views

Why is there a sandwich attack on the bsc.?How did it happen?

https://bscscan.com/tx/0xeef7b93a99dc9ba7285e495ac3fa61b704762d032669fc038120501d105d26c4 https://bscscan.com/tx/0x36a3b0323312e83a3ce2ce6e0ed390be844c3d12635031417f7fad6eb23766a1 https://bscscan.com/...
0
votes
1answer
28 views

Security question about erc 20 token smart contract

Is there any cheap ways (Under $300 dollars) to have the security of an ERC-20 token smart contract checked? Thank you to anyone who can help.
0
votes
0answers
54 views

How to check if token contains malicious code that transfers ownership of wallet?

There is a general scam going around this year where unsolicited ERC-721 (NFT) minting contracts, or ERC-20 token contracts, if interacted with by a victim, allows an exploit where the victim's ...
0
votes
1answer
20 views

How to interact between DB and smart contract?

I want to create a smart contract and when I transfer coin on it, it's automatically update on the DataBase (I use Cassandra), so you do your things on the website with it and you can win or loose ...
0
votes
1answer
53 views

Ethernauts level 25 solution help

I am wondering why my following solution to ethernaut's level 25 doesn't work when I execute it: (My own solution was similar to this blog post: https://medium.com/@appsbylamby/ethernaut-25-...
0
votes
1answer
20 views

Security about erc 20 token smart contract

Is there any paid resources out there that you recommend that could check the security of my ERC 20 token smart contract. Thank you to anyone who can help.
0
votes
0answers
90 views

in case we will mint all NFTs, did we still need add set price and withdrew function in solidity contract

greeting the next code is solidity contract code. it continue three functions. 1- one, take svg image and encode it to base64 to produce 'image uri'. 2- second one, take the 'image uri' and add to it ...
0
votes
1answer
81 views

What exactly is a proxy contract and why is there a security vulnerability involved in it?

I was looking at the recent FE badger DAO exploit and this Twitter thread in it https://twitter.com/CryptoCatVC/status/1466380960648380419?s=20 One piece of advice the author gives before signing a ...
0
votes
0answers
21 views

safest way to lock or burn LP?

I wrote a contract to buy liquidity as it sells tokens. The LP tokens are "public liquidity" that never shouldn't be removed from the pool. I actually send LP to the 0x0 address. As I only ...
0
votes
0answers
15 views

Has anyone spammed the Bloom Filter?

I've seen a (hypothetical) threat scenario where a malicious actor could spam LOG operations to populate the Bloom filter (making it harder for external services to index events). I also read about ...
0
votes
1answer
24 views

Is there a way for a user to complete a transaction on behalf of another user?

Suppose we have a smart contract that has one variable: url, and a updateURL function to update that url that only the owner can access. Suppose that, for the purposes of the contract, the url should ...
0
votes
0answers
14 views

PrivateKey storage in server security

I am using my privateKey from my wallet to perform certain actions in my contract. So far so good, but a question arose on how to more securely store my privateKey of my account on the server. At ...
0
votes
1answer
64 views

How to prove the NFT metadata were written by the issuer?

I would like to ask a question a little bit similar to How exactly can someone prove they were the creator of an NFT? In this scenario, the NFT is already minted. According to the description of the ...
0
votes
0answers
70 views

What's the worst that can happen if my metamask password was compromised?

I'm deeply ashamed to say but I got scammed on Discord with a link to a website that was advertising an NFT drop. I clicked on "Login with metamask" and it opened a fake metamask overlay ...
0
votes
1answer
23 views

Security issue in 0x in-chain example

I was going through 0x on-chain docs and I saw the official example here which calls an arbitrary contract swapTarget whose address is given as a parameter. It seems a huge security pitfall, as it can ...
0
votes
1answer
15 views

Is there a mechanism or app or technology to verify user controls public key?

I read somewhere that there is a way for me to verify that a given individual owns a public key. Unfortunately, I don't know where that article was nor what term to search for. For example, I want to ...
0
votes
1answer
87 views

Hacked Eth Account - What do i do with my staked tokens?

Unfortunately my Metamask wallet was hacked today on the Metamask app which i'm devasted about. I tried connecting Pancake Swap to it and it popped up asking for my words which i stupidly gave. The ...
0
votes
1answer
76 views

Can my funds be stolen by signing a defi contract in another network?

I'm starting to use metamask and I noticed that I'm able to change the network of the same address, so —after digging a little in the web— I now know that every new public address is created from the ...
0
votes
0answers
104 views

Ethereum was lost in both of my wallets because it was sent to another address instead of swapped

I have had a issue using uniswap while swapping my ethereum with saitama. I also had a separate transaction automatically occur without initiating anything on the same coinebase wallet account almost ...
0
votes
0answers
34 views

Remove fund from hacked wallet

I am now wanting to delete the wallet another person has control of to delete it...how can i do that? I heard electrum can clear wallets...i can't even find the app. the person has installed malware ...
0
votes
1answer
24 views

Utilizing random data provided by Math.random

I was interested in developing a generative project that would consist of lines of randomly generated text. Unlike projects that have already done something similar, this project takes it a bit ...
0
votes
0answers
34 views

Changing contract address in the ABI of the front-end

I am developing a react dapp and have a smart contract deployed on the test net. I am deeply concerned with regards to the security of this dapp. This question is very much related to this As I ...
0
votes
1answer
663 views

How this modifier nonReentrant work?

It's the source code from address 0x0d4535644fFeC908e39a711A01852Be40Bfe1C97, can the modifier nonReentrant prevent the re-entrance vulnerability? contract ReentrancyGuard { /// @dev counter to allow ...
1
vote
3answers
799 views

How to Tranfer Remaining NFTs And/Or Tokens Out of A Hacked Ethereum Wallet

I have a friend who got hacked recently. The hacker drained all of the valuable NFTs and ERC-20s out of the wallet. The hacker did leave some NFTs of lower value in the wallet. The victim of the hack ...
0
votes
0answers
30 views

Mystery MetaMask Wallet on Mobile (wallet exists that I did not create myself)

Every time I create a new MetaMask account, it works fine on the chrome extension, but the mobile app shows suspicious things. It creates a second wallet within my account that I did create or name, ...
0
votes
0answers
19 views

Is there a way to force a transaction to execute sonner within a block?

I'm building a DAPP game that would require users to submit a transaction after a specific block. The first one to have a transaction submitted and processed wins the round. As soon as the first ...
0
votes
1answer
22 views

Retrieving address of contract owner and making call to all smart contract methods

guys need some help related to enforcing security more on the lines of authentication in my smart contract. So I have a smart contract that has an owner as the deployers address. This owner will be ...
0
votes
0answers
34 views

Possibilities to abuse this auto-airdrop functionality?

I'm thinking of ways to airdrop my dynamically minted token. One of the ways would be to have 2 different buy functions on my smart contract: One of them would be a regular buy function that takes in ...
0
votes
1answer
18 views

Is there a re-entrancy risk if the contract does not store ether?

Let's say you have a payable function that immediately sends the payable amount to another account. It is possible for this function to be hacked? Or no? If the contract never ends up storing funds ...
0
votes
1answer
33 views

What is the process for actual validation of transactions?

What is the actual process of validating transactions on the blockchain? For example checking that no double spend has occured? I know PoW and PoS is more or less the mechanism used to select who get ...
0
votes
0answers
9 views

How difficult and what should I Google to create an App that allows one person to transfer a NFT to another person?

If I wanted to create a super simple app that would allow one person to transfer an NFT to another person, what things should I consider/Google and how difficult would that be? Obviously the biggest ...
1
vote
1answer
572 views

What (precisely) does "connect with metamask" allow a website to do?

I'm a developer and now using metamask as a user. To explore a dapp which is largely unknown to me, and how it functions, I have to connect my wallet, and I am given the message "only connect ...
1
vote
1answer
56 views

Can you get sued as a Smart Contract Developer? [closed]

I recently started work as a Smart Contract Developer. As a developer, can you get sued if the smart contract you deployed gets exploited and people lose alot of money? I think many of us work in ...
0
votes
1answer
41 views

Someone sent me .69 eth from a coinbase account. Should I be concerned? [closed]

Im noobish tbh, should I move everything to a hardware wallet? Should I move the eth out of the act so they cant take anything? Im sure I couldve been hacked somehow and someone got my keys. Any ideas?...
2
votes
1answer
983 views

Scam where unsolicited airdrop NFTs, if sold, empties victim's wallet

There are many reports of random NFTs being distributed to collectors' eth wallets on Opensea, and if the recipient accepts an offer to sell them, or lists them, they apparently verify a MetaMask ...

1
2 3 4 5
14