Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
0 votes
2 answers
35 views

ERC20 token smart contract check

I wrote a ERC20 token smart contract that I did not find any problems in my tests and reviews, honestly, I would like you to help me check this code and tell me its possible problems in terms of ...
Ali's user avatar
  • 51
0 votes
1 answer
20 views

Use offchain date time

in my contract, I need to do something based on time, and this is quite sensitive, and as we know, you cannot rely on the block.timestamp because it can be changed, I want to know if there is a way ...
Mehran Ra's user avatar
  • 375
0 votes
1 answer
17 views

Is it secure to use multiple admin

im trying to do multiple admin system in my solidity and here is example //SPDX-License-Identif`ier: MIT pragma solidity 0.8.15; import "@openzeppelin/contracts/access/Ownable.sol"; ...
Mert Tanıtan's user avatar
1 vote
1 answer
30 views

Building Cryptocurrency Tracking system for monitoring stolen cryptocurrency transactions

When hackers steal tokens from an account, what they generally do is divert the flow of tokens via multiple proxy accounts making it complicated for the cyber-forensics department to track final ...
Rohit Jambhulkar's user avatar
1 vote
0 answers
19 views

How to run a script which requires a private key completely in a browser?

For a non-technical person I need to create a page on my website, in the admin area, in which he'd regularly do stuff that normally is done on local machine only. That is, a person doesn't want to go ...
Nondi's user avatar
  • 49
0 votes
0 answers
17 views

Connect & interact with dApp without wallet connection

I have a question regarding the issues I am facing on my current project. I am building NFT marketplace on the Polygon network. The specific requirement is we should allow the users can interact with ...
legendary's user avatar
0 votes
2 answers
27 views

What are the best up-to-date secure approaches of generating pseudorandom number in Solidity? [duplicate]

I am thinking about creating a lottery with more than one winner and one round for users. Please don't consider usual 'commit-reveal' scheme. However, person can claim rewards on their own at the end ...
Victor's user avatar
  • 13
0 votes
1 answer
26 views

What is an re-entrancy attack and how does it work?

With the recent exploit on the omnipools on Conic Finance. The hacker used an exploit called: re-entrancy attack. How does it work explained in layman terms? And what should smart contract auditors ...
Patoshi パトシ's user avatar
1 vote
1 answer
92 views

What are the possible security threats when using mappings in Solidity?

Does the use of a nested mapping possess any threats to the security of the contract below? contract Users { struct User { address payable regAddress; uint64 timestamp; ...
Mila A's user avatar
  • 202
1 vote
0 answers
24 views

How to prevent replay attacks on ZK Proof Transactions?

Alice wants to prove a statement (let's say, she has a secret value x such that x * 2 = 10) to Bob without revealing x). Alice generates a proof using the ZK-Snark protocol. const { proof, ...
lordarora's user avatar
  • 296
1 vote
2 answers
139 views

Which of <= and < comparison operators use less gas in Solidity?

if(num <= 10) revert(); And if(num < 11) revert(); Which of these statements consume less gas? If we could save gas, we need not use less than/greater than equal to. We can just use less than ...
Pankaj Jagtap's user avatar
0 votes
1 answer
89 views

My coins were sent from my metamask wallet to another wallet without my consent

I just claimed tokens after a presale had ended from the token site to my metamask wallet. That transaction was successful. However, just one minute after that transaction took place, my coins were ...
john prasitsak's user avatar
0 votes
1 answer
38 views

Another contract is intercepting my contract calls and stealing the funds, what can it be?

This is the code I have, and I deployed to polygon mainnet to test. https://polygonscan.com/address/0x3CC3F39cc2386a8847378F4022917B3bB623BAFD // SPDX-License-Identifier: MIT // An example of a ...
Tsss's user avatar
  • 1
1 vote
1 answer
43 views

Can `msg.value` be trusted to remain the same after an external call?

Can msg.value be trusted to remain the same after the weth.deposit call in the foo function? pragma solidity >=0.8.19; interface WETHLike { function balanceOf(address account) external view ...
Paul Razvan Berg's user avatar
2 votes
1 answer
78 views

QuickAlerts Help!

I have been using QuickAlerts to track activities on my smart contract and receive a WebHook in my Discord server. How can I make sure that the WebHook is indeed coming from QuickAlerts and not a ...
Tien's user avatar
  • 193
0 votes
1 answer
47 views

Is it possible to do two-factor verification (email, text, let's say) using ethereum?

One of the values of a trusted, centralized authority is that it can use two-factor authentication to establish a permission to do a given action. Is it known whether an ethereum smart contract can ...
Larry Freeman's user avatar
0 votes
1 answer
82 views

Can't reproduce reentrancy if the smart contract has >= 19 ether in remix

I'm trying to understand reentrancy in solidity. I took the example from https://solidity-by-example.org/hacks/re-entrancy/.\ You can also take the original one if you want, the result is the same. ...
isaac's user avatar
  • 3
1 vote
1 answer
32 views

What does it mean by "rollups sends transactions on mainnet"?

While trying to understand what rollups are, I read rollups sends transactions to mainnet in a batch. I don't understand why and practically what does it do. To better understand it, I came up with a ...
Stav Alfi's user avatar
  • 206
0 votes
0 answers
16 views

How to improve the performance of a smart contract and secure it

I wrote a simple contract that exchanges the ERC 20 token for USDT, how can this code be improved in performance and what flaws or vulnerabilities it has // SPDX-License-Identifier: AGPL-3.0 pragma ...
Lll Cilician's user avatar
0 votes
1 answer
256 views

Detecting scam tokens on bsc pancakeswap

Certain contracts cannot be sold after buying on pancake swap apparently because they have code that makes that so. This is one example: 0x6d041ae2494641c229e9e348616f40bf390aa3f8 How is it that token ...
BAR's user avatar
  • 135
1 vote
2 answers
32 views

Ways to earn ETH passive income

I have a decent amount of ETH in my cold wallet (<32 ETH). These bag of ETH is my HODL bag, meaning that I don't want to spend it and I am planning to hold it for the next 10-20 years. What are my ...
Chunior's user avatar
  • 11
0 votes
1 answer
28 views

Identifying a Reentrancy Attack Vulnerability

Can this function be subject to a reentrancy attack? Are there simple code smells for identifying them? function collect() external { payable(owner()).call{value: address(this).balance}(&...
Emanegux's user avatar
  • 123
0 votes
0 answers
20 views

does empty function has security risks?

I have to implement the following interface in my contract interface IMetadataRenderer { function tokenURI(uint256) external view returns (string memory); function contractURI() external view ...
sciNFTist.eth's user avatar
0 votes
1 answer
125 views

When should I use ReentrancyGuard in a smart contract?

I am looking at the ReentrancyGuard smart contract from Open Zeppelin and I don't understand when I have to use it. Is it necessary in all my smart contracts or do I only have to add it in some ...
Falcon Stakepool's user avatar
0 votes
1 answer
127 views

Constructor arguments from EVM bytecode

I have a contract that results to the following bytecode: ...
oyinda david's user avatar
0 votes
0 answers
15 views

is EnQlave by QRL for post quantum Etheerum dependent on QRL Blockchain?

EnQlave is an initiative by QRL to secure Ethereum blockchain against quantum attacks. What QRL people claim is that the EnQlave wallet will not be dependent on any other blockchain other than ...
Anantashayana Hegde's user avatar
1 vote
1 answer
25 views

What is a good use case for .call functions' ability to pass a function call?

Following up on this thread, I wish to understand what will be a good use case using the feature to call a function in .call{}() ?
Mrigendra Soni's user avatar
1 vote
1 answer
28 views

storing and retrieving data in Solidity

in another solidity study, I want to implement a contract to store user links. users must log in using the wallet address and be able to save data by name, description, type, and the link itself. ...
Lll Cilician's user avatar
2 votes
1 answer
94 views

Security and Performance of Solidity Contract

I continue to explore solidity. I wrote a small distributor contract that collects ETH from incoming transactions, records the addresses of incoming transactions with a given condition, and ...
Lll Cilician's user avatar
2 votes
1 answer
152 views

Is my Smart Contract Secure and Optimized properly?

how safe is this code and is it possible to optimize it // SPDX-License-Identifier: AGPL pragma solidity ^0.8.17; interface IBEP20 { function transfer(address to, uint256 value) external returns ...
Lll Cilician's user avatar
1 vote
1 answer
248 views

Fake BUSD transcation sent from my wallet (not fake 0 token scam)!

Transaction Hash: 0x7800fb4d9345fc7e8b2794a479f414948eb1a9126e14daff11d1802440996a68 The hackers sent fake busd token (with >0 amount) from multiple victims wallet to another wallet without any ...
ken's user avatar
  • 11
0 votes
1 answer
45 views

Error: Expected string literal (path), "*" or alias list

I m currently working on smart contracts and i m trying test the contracts i wrote. I am using smartbugs tool. So far, i have executed the following commands in the powershell, git clone https://...
Porkodi Ishwarya's user avatar
0 votes
1 answer
38 views

Can i use oyente Tool on windows?

I am currently working with smart contracts. I want to perform security analysis on the smart contracts I developed. I tried using Oyente Tool and Docker in my Windows 10 Home system. But I can only ...
Porkodi Ishwarya's user avatar
2 votes
1 answer
64 views

How can ERC20 tokens be obtained in a local hardaht forked environment?

I've been learning about ethereum for a short time, besides my English could be better; if I'm wrong about something, please correct me. 😁 I am trying to test the interaction of different contract ...
4nibhal's user avatar
  • 21
0 votes
0 answers
7 views

What is smart contract re-entrance vulnerability?

What is re-entrance vulnerability? How can I prevent a smart contract from being re-entrant? What are some common vulnerabilities to watch out for?
PSS's user avatar
  • 519
1 vote
0 answers
68 views

How to pass web3 client from server to client in next.js?

I spent all day (meh, not a record (but I'm not finished yet lol)) trying to pass the web3 instance to the client side of my app. Why would I use it on the server side? Well, to keep my wallet ...
Eugene1111's user avatar
3 votes
0 answers
16 views

Ethereum sharding minimum committee size of 111 for safety

I am currently researching the minimum committee size required for Ethereum sharding. According to Vitalik, the minimum number of validators in a committee associated with a malicious committee ...
EagleEdge0423's user avatar
1 vote
1 answer
33 views

Can an encrypted message be safely revealed

In this demo Alice is using Bob's public key to sign a message that only the Bob can decrypt. Is it safe for Bob to reveal this decrypted message, or would that allow an attacker to determine his ...
Origin's user avatar
  • 133
0 votes
1 answer
67 views

Why is dangerous to share metamask logs?

Sorry for the noob question, but if the Metamask logs don't contain a secret phrase, why is it dangerous to share it online? Also, can hackers get hold of my Metamask wallet logs without hacking my ...
Alder's user avatar
  • 1
2 votes
1 answer
237 views

Best way to store private data in smart contract

I wanna to store some personal data as a string to my smart contract with simple store function like a note: mapping (address => string[]) private addressToNotes; function store (string memory ...
Alireza's user avatar
  • 350
2 votes
2 answers
898 views

NEED help - MEV bots attacking our liquidity pools - how to counter or block the MEV bots?

Intro We have 2 tokens in our project and 3 liquidity pools ( "token1-ETH", "token2-ETH" & "token1-token2"). Token1 has ~5% of fees and includes reflection. Token2 ...
Ra Murd's user avatar
  • 43
0 votes
0 answers
8 views

Can logging into your etherscan or signing into google through web3 dapp browser be a mistake?

Let's say an inexperienced user logs into their Google account through the ol "trustbitmask" wallets browser to get random things like email passwords etc. So they can log on to their ...
Bimb0unit256's user avatar
0 votes
1 answer
27 views

Is it 100% guaranteed that a process that listens to blockchain events will receive them if they get emitted?

When a smart contract emits an event, if I am listening to them for example with an application that stores all events from that smart contract into a database, do I have the certainty that I won't ...
Falcon Stakepool's user avatar
1 vote
1 answer
57 views

What happens if 51% of validators in an epoch vote for an invalid block

Hypothesis Full nodes that run both valid execution client and consensus-client would end up in a sort of deadlock and stop syncing. The consensus-client would try to feed the execution client with a ...
Tobias Bergkvist's user avatar
0 votes
1 answer
101 views

Restricting Access to Solidity Callback Function

I have a solidity contract that executes arbitrage trades with flash loans. In order for the flash loan pool to call the contract callback function after transfering the funds to my contract, that ...
Chev_603's user avatar
  • 157
1 vote
0 answers
223 views

My Goerli wallet has been drained

I want to open this question from overflow since it was closed and I experience the same problem. This account "0x87C02eeacB08c11aFBb821798DB2F4cCcd8F9E3d" has been stealing many goerli and ...
ethereal1m's user avatar
0 votes
0 answers
21 views

Differentiate a real and counterfeit NFT with the same name and symbol

Regarding this "We also remind everyone that any smart contract can use the same name and symbol as your contract.", then how do users identify a real and a counterfeit NFT series? If I ...
AliFI's user avatar
  • 1
2 votes
1 answer
38 views

Why optimistic rollup chains can take a week, while ZK don't?

Optimistic and ZK rollups, both submit data to Ethereum or similar chain, but why do optimistic rollups take longer time then zk rollups? What's the core difference that causes this time difference?
aakash4dev's user avatar
0 votes
0 answers
19 views

Why do optimistic rollups take 1 week to transfer data between blockchains?

There are 2 types of layer 2 rollups basically: optimistic rollups and zk-rollups. Why do optimistic rollups take 1 week, and zk-rollups take a few minutes. I don't understood that part.
aakash4dev's user avatar
1 vote
1 answer
26 views

Whata are the differences between Ethereum and Ethereum Classic?

What are the key differences between Ethereum and Ethereum Classic and what implications do they have for the future of the Ethereum network?
vgonearth's user avatar
  • 139

1
2 3 4 5
17