Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
0 votes
0 answers
6 views

is pull over push pattern recommended for erc20 withdrawal too?

I had a chance to read the pull over push pattern for transferring/withdrawing ethers, but i'm not sure if i need to apply this for erc20 transfers. i.e. function buy(uint256 _someId, uint256 _price)...
user avatar
0 votes
1 answer
29 views

Reentrancy Ethernaut Challenge

I have been trying to pass the Reentrancy attack challenge of Ethernaut. Hence, I am creating this issue to ask help from anybody who knows where is the problem coming from. First of all, here is the ...
user avatar
0 votes
0 answers
12 views

How to bypass the openzeppelin-contracts Address.sol check and "tx.origin == _caller"

I am trying to create a smart contract for to mint NFT and token for security purpose, but I often got stuck with the contract checking, does anyone know if I can bypass those checking?
user avatar
0 votes
0 answers
24 views

Make user withdraw tokens

As a best -and most secure- practice, how do you make an user to withdraw tokens from your contract, without them having to initiate the withdrawal procedure (aka calling a withdraw function), instead ...
user avatar
  • 307
0 votes
0 answers
20 views

Possibility of spoofing miners in Ethereum

Ethereum uses node IDs to identify nodes uniquely and to route traffic between nodes based on the node discovery protocol (https://github.com/ethereum/devp2p/blob/master/discv4.md) built on Kademlia-...
user avatar
  • 46
0 votes
0 answers
9 views

Permissioned networks vs Access Control in public networks

I've been working with both public and permissioned EVM networks the last years. Everybody is aware about the benefits of public networks in terms of security, community, solutions ecosystem, ...
user avatar
  • 636
1 vote
0 answers
12 views

Solhint "Explicitly mark all external contracts as trusted" - how to fix

From my smart contract I am emitting an event defined in the interface (that my contract inherits/implements). I keep getting solhint warning about "Explicitly mark all external contracts as ...
user avatar
0 votes
0 answers
16 views

Is it worth it to deeply understand the EVM to become a smart contract auditor?

I have a huge interest in becoming a smart contract auditor and wonder if it is worth the time to really learn how the EVM works? It seems like most if not all vulnerabilities I read about are because ...
user avatar
1 vote
1 answer
25 views

Invalid ENS name in Damn Vulnerable Defi (naive-receiver)

I'm trying to solve the Damn vulnerable Defi challenge's Level 2 - Naive Receiver. We have to drain the user's balance by exploiting the missing access control allowing anyone to be the borrower and ...
user avatar
0 votes
2 answers
10 views

Why there are people who want to have multi-accounts in Ethereum?

Why there are people who want to have multi-accounts in Ethereum? I notice that in the Ethereum ecosystem, more and more people own more than one account, what motivates them to create more than one ...
user avatar
0 votes
1 answer
29 views

VsCode + Solidity 0.8, still underflow

I am running this contract on VsCode + Solidity 0.8.13: // SPDX-License-Identifier: MIT pragma solidity ^0.8.13; import "hardhat/console.sol"; contract Token { mapping(address => ...
user avatar
1 vote
2 answers
22 views

Is the key generated below valid and cryptographically secure?

For some reason, my React Native 0.68.0 app needs to generate private key for the Ethers wallet providing accessing to crypto.getRandomValues. The crypto.getRandomValues is polyfilled by react-native-...
user avatar
0 votes
2 answers
14 views

Encryption or hashing with data

The data which we send via Ethereum blockchain , is it ecrypted and sent to sender only & never stored on blockchain OR is it hashed ? Hashing is a one way process . It means that the data once ...
user avatar
0 votes
0 answers
22 views

Need some feedback on my NFT smart contract. Trying to ensure it's 100% donatable

My goal is to create an NFT Project that 100% of the mint proceeds are automatically donated to a select number of whitelisted addresses. Just would like someone to take a look and make sure I'm doing ...
user avatar
  • 101
0 votes
0 answers
30 views

Having trouble using Slither with big contracts with lots of imports

I am trying to learn smart contract auditing and Slither seemed like a good tool to use to catch low hanging fruit or point to potential bugs. However, no matter what I do I cannot get it to work with ...
user avatar
0 votes
0 answers
13 views

How to be able to generate new addresses for my users but avoid having to keep private keys on a server?

I'll have a service where users will deposit funds. How would be able to generate new addresses for my users but yet avoid having to keep private keys on a server? I could pre-generate them locally on ...
user avatar
0 votes
1 answer
35 views

Which type of operations are not confiables to be made on-chain?

I already saw a bunch of people talking that some operations are not safe to be made on-chain so it's better to receive this information as a function parameter from an off-chain source, but I did not ...
user avatar
0 votes
0 answers
11 views

can someone skip threw my contract and let me know if i have any faults

i would appreciate any feedback, i will be adding reentrancy guard aswell but if there is any obvious improvements please let me know. This is still a work in progress ! // SPDX-License-Identifier: ...
user avatar
1 vote
1 answer
38 views

What is MetaMask's security model?

Does it download block headers, like a Bitcoin SPV wallet? Or does it rely on a service like Infura to provide an API that it trusts to tell it what it holds? If the latter, could the service lie ...
user avatar
0 votes
0 answers
31 views

Any security issues with allowing a DApp access to "signing keys"?

Want to use mirror.xyz, but the DApp does not let you do anything without singing the following message in your wallet: I authorize publishing on mirror.xyz from this device using: {"crv":&...
user avatar
  • 155
0 votes
0 answers
18 views

Why this DAO attack doesn't work as expected?

For a course I'm taking we've written a smart contract that is vulnerable to recursive calls. pragma solidity ^0.4.24; contract Fundraiser { mapping(address=>uint) balances; constructor() ...
user avatar
0 votes
0 answers
10 views

What are Metaverse developers' security concerns?

this is my first post in EthereumSE, I would appreciate you in advance fr your kind welcome and helpful answers and comments. As a simple search shows, Metaverse is using Blockchain infrastructure. AR ...
user avatar
  • 103
0 votes
1 answer
37 views

Is it possible to make certain fields of a structure only available to contract owner?

For example, given the following structure, I want some fields to be visible only for the contract owner struct Participant{ address participantAddress; // can be seen by anyone string team; //...
user avatar
0 votes
1 answer
17 views

Could anyone experienced tell me if i have any obvious flaws in my smart contract please

I am very new to solidity, i have been playing around for about a week now and have created my first "good" bit of code i want to turn into a dapp. I would just like to see from a experts ...
user avatar
0 votes
1 answer
110 views

Security of Solidity versus Rust

I recently started learning Solidity, and I am interested in security aspects. Today, I encountered a very interesting blog article discussing security vulnerability in Rust. At my level of ...
user avatar
  • 3
0 votes
0 answers
42 views

Handling encryption of data in smart contract based app (specific scenario)

Small heads up, I'm a complete beginner, so many concepts are still unclear for me. Please correct me at any point if I'm talking nonsense. My question is how should data stored in a smart contract be ...
user avatar
0 votes
0 answers
37 views

Should I not use re-entrancy guard if multiple people might be calling the function at same time?

I went through the openzeppelin's implementation of re-entrancy guard. https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/security/ReentrancyGuard.sol I find the state ...
user avatar
  • 62
0 votes
1 answer
33 views

Who can edit an existing smart contract?

Is there any mechanism that limits the possibility of deploying a new version of existing smart contract so that only its author can do it? Or a mechanism which indicates that smart contract A is a ...
user avatar
0 votes
0 answers
28 views

Does a Rollup transaction need the parameter 'nonce'?

Recently I am learning Rollups, and one thing makes me confused is that, Does the compressed transaction in a batch need the parameter nonce? Here in on-chain-scaling-to-potentially-500-tx-sec-through-...
user avatar
0 votes
0 answers
15 views

Consortium networks - safety concerns

After studying the different types of blockchain networks and their advantages in the enterprise space and after opting for permissioned networks to form a consortium, my questions are: What are the ...
user avatar
0 votes
0 answers
46 views

How to store secure private keys on a server, that are being used for 'gasless' minting using EIP-712 based messages?

NOTE: By 'gasless' I mean that I won't have to mint the tokens for the user, they can mint it themselves provided they have a valid signature. Hi, In my NFT (ERC-721) contract, I'm allowing callers to ...
user avatar
0 votes
1 answer
89 views

When does a payable function "claim" or "take" the sent ETH?

For a smart contract function to receive Ether, it is marked payable. Is there a specific point in the execution of the code where the sent value is "claimed" or "taken" from the ...
user avatar
  • 69
1 vote
1 answer
80 views

Is "approve" required only for transferring tokens? Not a native coin?

Speaking of Ethereum blockchain, or any other one compatible with it: Polygon, Avalanche and others: is calling the function approve(...) mandatory only, and only, when there's a token involved in ...
user avatar
0 votes
1 answer
23 views

Verify a transaction response correctness

In my dapp users are sending transaction to my db, but a malicious user could just generate thousands of fake TransactionResponse and send them to the db, forcing me to check all of them to know if ...
user avatar
1 vote
1 answer
63 views

Can you get a duplicate hash with params that are NOT a string or array, using keccak256(abi.encodePacked(a, b))?

It's relatively common to confirm a msg.sender is pre-approved for some contract interaction by verifying a signed hash of their address and another parameter. For instance: bytes32 checkHsh = ...
user avatar
  • 69
0 votes
0 answers
35 views

Secure Wallet Architecture Ideas

I have been tasked with developing a wallet that can store Cryptocurrency and NFTs. I understand that cryptos and nfts are not actually stored in the wallet, but the private keys that are used to ...
user avatar
1 vote
2 answers
104 views

Tools to see which contract addresses have approval to spend your tokens and revoke access to them in bulk?

Is there a tool to see which contract addresses have spend permissions for my tokens? And potentially revoke them if needed in bulk.
user avatar
0 votes
1 answer
113 views

View mint date for ERC-721 / ERC-1155 token

I was wondering if it's possible to calculate the initial mint date for a token. I was thinking perhaps one could check the block-timestamp for the transaction in which a token was first minted? I was ...
user avatar
  • 101
1 vote
0 answers
20 views

Transactions that led to the discovery of TheDAO hacker

What are the transactions that led to the discovery of the apparent hacker of TheDAO? What are the primary transactions across the Ethereum, Bitcoin, and Grin blockchains?
user avatar
  • 78.3k
0 votes
1 answer
15 views

Prevent use of Contract Functions - Non Verified Non Published

I have run into a problem and don't know the best practice for this. I am developing a game with Unity and using it to communicate with my EVM contracts. eg. backend gives a variable gold = 100 from ...
user avatar
1 vote
0 answers
26 views

How long can a Metamask password be?

How long can the Metamask password be, that encrypts my private key? I would like to make it as long as possible.
user avatar
0 votes
0 answers
24 views

my ether got transferred to another account without my permission

My ethereum metamask account is 0x5E927734820f3bd1a8f3AFcDfC88D5cC89056aD3 and the moment friend of mine sent me ether, it was automatically got sent to some another account. This is the transaction ...
user avatar
  • 1
0 votes
0 answers
12 views

How can i prevent created token use another account?

I have 2 account diferent metamask. Account A and account B. i deploy SimpleToken contract with account A and i get contract address on mumbai. Miner contract is import SimpleToken for mint and ...
user avatar
  • 1
0 votes
3 answers
76 views

How to implement security to only allow my dApp to interact with my smart contract?

I am working on a dApp that grabs json info based on the logged in metamask user. That info is passed on to my contract to allow the mint function to execute based on the value. So for example if the ...
user avatar
  • 65
0 votes
0 answers
10 views

How to mask payment paths in smart contract

I am working on a dapp that would pay out providers for various services. The service providers would request funds from end users, who would then pay via smart contract. This smart contract would ...
user avatar
1 vote
0 answers
24 views

Security for play-to-earn action game

So I'm making a play-to-earn game, that is a web game and its logic runs on the user's machine. After the player finishes a session, the game will call the following mint function: contract GoldCoin ...
user avatar
0 votes
0 answers
36 views

Is there a site to see which sites or contracts have full access to my ETH address?

I have an old ETH address that I used to use for everything. How do I know which sites or contracts have FULL access to my address? I know metamask has an option to see which sites are connected, but ...
user avatar
2 votes
2 answers
217 views

Found old wallet with random tokens on it. Can I get hacked if I try to send or sell these on UNISWAP?

I have an old ETH address and there are some airdrops or random tokens I received. How can I check to make sure these tokens are not scams. Is it possible that if I send these tokens or try to sell ...
user avatar
0 votes
2 answers
103 views

How do you make a signature valid for only one transaction?

I asked this question before but I worded it ambiguosly. I have a function in a smartcontract that should only be accessible by users who have a signature, issued by the contract owner. The goal is, ...
user avatar
0 votes
0 answers
83 views

My MetaMask account was compromised, but I don't know how

On Feb 2, 2022, a hacker drained ~$500.00 of ETH from my account which I set up with MetaMask. You can see the transaction here: https://etherscan.io/address/0xde505c5d1897d6101fc442e5ae093814b5c3fe0f ...
user avatar
  • 1

1
2 3 4 5
15