Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
0
votes
1answer
19 views

Is there a case in which selfdestruct is more “powerful” than throw or revert?

Example in this scenario I guess selfdestruct will never get called (also: contract A isn't so important by the way just focus on B onward): in Contract A: address contractb = 0x....; function ...
0
votes
1answer
13 views

Can you change a variable outside of a function (assuming this variable may be a constant)?

In other words if a contract looks like this: contract tokenX { bool public started = true; function end() { started = false; } } So everyone should be able to call end() but can someone call "...
0
votes
1answer
22 views

Alternate to Allowing Insecure Unlock

Several places say insecure unlock is poor practice. Yet this module I am learning implements it. Where can I find a way to Deploy an account without insecure unlock Here is repository with files I ...
0
votes
0answers
27 views

Unable to Unlock Account Even After specifying allow-insecure-unlock

Software: Ubuntu on VirtualBox Update, tried putting two dashes, on allow-insecure-unlock, doesn't work solidity@solidity:~$ geth attach http://127.0.0.1:8545 --allow-insecure-unlock Incorrect Usage:...
0
votes
0answers
16 views

Problem with understanding the solution for Transaction Ordeing Vulnerability

For the following paper, I can’t understand the text written below: https://arxiv.org/pdf/1806.01143.pdf Our violation pattern checks that the amount of the call instruction is determined by a ...
0
votes
0answers
15 views

Backward program analysis (like symbolic backward execution) tools for smart contracts

I know there are some backward program analysis tools for traditional softwares, but i wonder if there are already backward symbolic execution tools for smart contracts, or any tool that I can refer ...
0
votes
1answer
28 views

ERC20 vulnerability? Executing transferFrom undesirably

Say I have a contract called MyContract, and I require to send 100000 DAI to it. Ideally, I'd firstly call approve(<address of A>, 100000e18) in DAI's contract itself. Secondly, I'd execute, for ...
0
votes
1answer
28 views

How dangerous the 'short address' attack is as of 2019, October and what ways there are to mitigate it?

From what I read there's a well public knowledge of reantrancy and underflows/overflows due to the cases of documented hacks and stolen ether - yet the short address attack seems less known. I know in ...
0
votes
2answers
30 views

Is there a way to create double-spending transactions and submit them to different nodes?

I'm trying to create two transactions with the same nonce and send those transactions to two different nodes. Such as: const Web3 = require('web3'); const web3_1 = new Web3(rpcURL1); // node 1 const ...
0
votes
1answer
36 views

How to build security into Dapps?

I am building a loan dapp. The functionality is not easy to build but relatively straightforward. My question is though does anyone have any suggestions of how to build in user logins and security? ...
0
votes
0answers
13 views

Hidding IP address behind sentry nodes

I would like to know how to set up an Ethereum node behind sentries (proxy nodes). I know there are several ways to approach this issue as mentioned here. https://medium.com/@kidinamoto/tech-choices-...
0
votes
1answer
13 views

Can a miner delay a transaction?

Say that my wallet is connected to a malicious miner. Of course this miner can DoS me and ignore all my transactions, but can they withhold it and release it to the network in the future? Or is the ...
0
votes
0answers
27 views

Can you verify transaction data by matching it to the transaction hash

TlDr; Can you use the transaction hash to confirm the integrity of the data components of a transaction (post data, addresses, nonce, etc). In my application, I have a connection to the Ethereum ...
0
votes
1answer
31 views

dApp design and security question

I'm designing a dApp where users can submit work they've done (files) to ipfs/swarm. To get credit for the work they then reference the hash of the files when calling a smart contract. What are some ...
1
vote
0answers
24 views

Is there a curated list of known security vulnerabilities related to escrow?

In Factories Improve Smart Contract Security, Steve Marx says that: This bug was hand-picked to show the benefit, but this bug is representative of a large class of bugs around escrow. In my ...
4
votes
1answer
38 views

Why is the subcall gas limit set to 63/64th of the remaining gas?

From the solidity docs: Calls are limited to a depth of 1024, which means that for more complex operations, loops should be preferred over recursive calls. Furthermore, only 63/64th of the gas can ...
1
vote
1answer
24 views

Why OpenZepplin always use private visibility for state variables?

Why OpenZepplin always use private visibility with getter functions for its state variables? I can't find a reason why they are not using public, is there any potential security or gas cost difference ...
0
votes
1answer
33 views

Gas optimisation for my art experiment spacecans.com

so I was microdosing some research chems and the thought came to me that I need to do some artsy blockchain stuff for once. It's two tin cans floating in space that you can advertise your so-called ...
2
votes
1answer
33 views

Getter functions for loop security

Is there any security issue when making for-loops inside getter functions ? Let's say the array is very large, and it takes a long time to loop through the array. Is it a potential threat or I can ...
1
vote
0answers
36 views

Help hacking this contract

This is a very simple contract that I can't hack and I'm stuck, I need some help to get the concepts right. pragma solidity ^0.4.10; contract SimpleToken { mapping(address => uint) public ...
0
votes
1answer
22 views

Risk of Messages Not Having a Signature

As per my understanding transactions are signed before sending to Ethereum. Else, no transfer of Ether will happen. However, messages sent to Smart Contracts (SC) aren't signed (e.g., using methods....
1
vote
1answer
26 views

How mining happen in private and permissioned blockchain?

In public blockchain a miner gets rewarded for mining a block. But in a private or permissioned blockchain, if there are no rewarding facilities available, how does the mining happen? Also, is it ...
0
votes
1answer
18 views

Is it safe to share my signed transaction publicly?

If someone got hold of my Ethereum signed transaction, is my wallet still safe? Can they extract the raw transaction from the signed transaction to get my private key?
0
votes
1answer
56 views

Solidity: extract data from signed message?

In an effort to reduce gas costs for users, I'm looking for a way to delegate certain transactions to a contract owner so that the owner makes a transactions that would have been otherwise sent by the ...
1
vote
1answer
49 views

Off-chain authorization system

I'm working on a dapp and am running into a dilemma regarding how to balance trustlessness with the cost of transactions for users. In order to reduce gas usage by users, I want to be able to able to ...
1
vote
0answers
13 views

How exactly theᴅᴀᴏ reentrancy hack was performed without having weiGiven>0 nor IsAllowed(WithdrawAddress)?

The well known ᴅᴀᴏ hack didn’t affect ether balances of theᴅᴀᴏ but balances of rewardAccount. That’s why I’m talking about the hack version which affected contract balances of theᴅᴀᴏ itself. With ...
1
vote
1answer
25 views

Is it possible to manipulate maximum callstack size in solidity?

I'm a student learning about solidity language. According to solidity's official docs, the maximum callstack size is 1024. But, I am wondering, can a developer change the maximum callstack size in ...
0
votes
1answer
14 views

Can I rely on certain oracle to know the precise and reliable timestamp?

I am learning the security impact of smart contract on system properties like block.timestamp and block.number. I understood that block.timestamp can be controlled by the miner to certain degree and ...
0
votes
1answer
12 views

What does this payment fragment mean?

I am trying to comprehend the following snippet of payment code: if (collectedFees >= minFeePayout) { if (!owner.send(collectedFees)) { // Potentially sending ...
3
votes
1answer
33 views

What is the “pre-commit” scheme to defeat TOD attack?

I am writing to inquire feasible strategies to defeat Transaction Ordering Dependence (TOD) bugs. I learned from the best practice guideline such that we can use a so-called "pre-committed" scheme ...
0
votes
0answers
28 views

how to implement erc1400 standard?

I am trying to learn about erc1400 and its implementation but couldn't find any complete implementation guide. Can someone points me to relevant links regarding erc1400 complete end to end ...
0
votes
1answer
51 views

Griefing Attacks: Are they profitable for the attacker?

The following article explains one of the solutions for indirectly validate a block when cross-sharding transaction between two shards to prevent invalid blocks. The article called one of these ...
1
vote
1answer
39 views

adaptive vs. non-adaptive adversaries? Is there a precise, unique and general definition? (Updated)

In this Ethereum github page (Link to the page: https://github.com/ethereum/wiki/wiki/Sharding-FAQ#what-are-the-security-models-that-we-are-operating-under) there is a very brief definition of the ...
1
vote
1answer
40 views

Strict Balance Equality (Security Issue)

Research Paper, Page-5(Strict Balance Equality)I have read that attacker can use Selfdestruct() and forcibly send ethers to the contracts. My questions are: If Selfdestruct is meant for owner of ...
0
votes
1answer
57 views

Proxy function clashing - what kind of danger comes exactly with it?

I read that if I am using proxy, there is a chance of function clashing. Let's say in my contract there is a function with a signature: proxyOwner() ...
0
votes
3answers
48 views

How do I attack the `Vuln` contract?

How can I steal from Vuln contract? I have made another contract to try to steal from Vuln but it always gives me an error. And I'm not sure how to send the money to my adrress. contract Vuln { ...
0
votes
1answer
51 views

User anonymity while submitting data in smart contract

I've written a smart contract, that is a crowd sensing system. Where post posting a task user view that task and if they have what I'm asking for/and meet the task requirements they submit certain ...
0
votes
1answer
8 views

How to restrict call to inherited public function

I'm using OpenZeppelin library for my project and I need to override some functions for business logic. But my concern is with given example, // contract from library contract A { function ...
1
vote
1answer
34 views

How to access a smart contract function protected by access rights using Web3?

I have a smart contract address for security tokens, and certain functions of it are protected by access rights, for which I have an address to access those functions, however I am not able to figure ...
0
votes
1answer
24 views

Is this implementation of multisig2of3.sol secure? [closed]

I implemented multisig 2 of 3 contract. Please give me feedback on codestyle, security and usability. On codereview there is only two solidity questions, so I posted here. see on github pragma ...
0
votes
0answers
24 views

Understand the `call` opcode in this contract

Hello, I am posting a quick question regarding the functionality this contract: https://etherscan.io/address/6b63ea3612dde97082aab468157950f927618d31#code From the source code, I am not even able to ...
0
votes
1answer
20 views

Understand the potential issue of miner controlled gaslimit

I am aware that smart contracts running on top of EVM can access certain system properties such as timestamp, block number, and gas limit. I am also aware that such properties can be controlled by ...
2
votes
2answers
942 views

Issue with New version of Metamask: Remix cannot detect the Metamask address

I have just installed Metamask version: 6.3.1 Now in Remix, the address of my account in metamask is not detected. The account box in remix remains always blank now (see picture below). Note that I ...
2
votes
1answer
56 views

function input conditional check

I have a function which is accepting a string argument as input parameter. This string is an IPFS hash and I would like to check that the input is actually just that and not a malicious link or the ...
0
votes
1answer
62 views

msg.sender 'spoofing' when function is public or external

I have a Smart contract where I want only the onwer to call a specific function, for example: function getInfo() view public onlyOwner() returns (address) { return msg.sender; } ..... modifier ...
1
vote
0answers
15 views

Understanding a simple online contract which seems not functional

I am writing to understand the functionality of this contract (https://etherscan.io/address/0x1f14b77e9f4844889fa63bc1e5180c8b90ec18db), this does not look even "functional" to me. Here is the ...
1
vote
0answers
29 views

What are the drawbacks of layer 2?

The scalability trilemma states that a blockchain can only have two out the following three properties: decentralization, scalability, and security. Layer 2 protocols aim to make Ethereum more ...
2
votes
0answers
84 views

Is there any dynamic symbolic execution tool for smart contract [duplicate]

There is a question (Security analysis tool for Ethereum smart contracts) similar to me, but it presents mostly static analysis tools. I'd like to know if there is any better dynamical analysis tool ...
1
vote
1answer
22 views

Is there any concern for the significant number of nodes being hosted on AWS/ cloud providers?

Just curious if there is any downside that many nodes are being hosted on cloud providers? For example Infura, which supports many nodes and provides a large portion of connections to Ethereum nodes, ...
0
votes
1answer
30 views

Is a function prone to re-entrancy attack even if I set balance to zero within the same function (example included)

Such as in this scenario, is the hackable via re-entrancy? thanks... function withdraw(uint256 money) public { if(money <= balance[msg.sender]) { (bool success, ) = msg.sender.call....