Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
1
vote
2answers
26 views

How does proof of stake prevent past blocks from being changed?

I have a question about Proof of Stake. Are there any protections against a user just creating an entirely new chain, since there is no computational penalty for creating a really long chain, couldn't ...
1
vote
0answers
15 views

Difference between SMTChecker and Manticore?

Why would I use Trail of Bits' Manticore over SMTChecker, which is baked in the Solidity compiler?
1
vote
0answers
38 views

msg.sender and tx.origin - how to use them in practice? [duplicate]

I wrote a contract A that uses msg.sender for authentication: When A creates an item it stores msg.sender in itemsOwners mapping (itemOwners[itemId] = msg.sender;). Later A compares msg.sender to ...
1
vote
0answers
16 views

Cost of forking Augur

Augur Version 2 is scheduled for launch on July 28th 2020. How can the cost of forking Augur version 2 (by disputing a market resolution) be calculated in REP? How dies this cost compare to the cost ...
0
votes
0answers
12 views

Suggest solution and/or literature on secure distributed voting

I'm a complete noob when it comes to blockchains and cryptocurrencies, but I am quite skilled with math and CS, so hopefully I am able to ask the correct questions and understand the answers For a ...
0
votes
1answer
31 views

Can someone read this private variable?

my purpose is to generate a random key when the smart contract is created and save that key in a private variable. I don't what to know its value either. Let's take for example the code below: pragma ...
0
votes
1answer
34 views

How can I prove my friend having changed just one word in the seed and have it lay around is super insecure?

My friend said to me that he has his seed saved in Google Drive and that he is absolutely safe even if someone found it out. He even gave me his seed to try to break it. I know that all I have to do ...
0
votes
0answers
20 views

Validating transactions with ZK methods

After reading some topics on the implementation of ZK methods in the Ethereum, how would this affect the PoW? Please have someone correct me if I am wrong (I started recently), but if the nodes need ...
0
votes
2answers
44 views

Sending extra data beside or inside a new smart contract

I'm doing a research about Ethereum smart contracts security and I need to send some extra data (for example some json data) beside or inside a new smart contract when I'm deploying that contract on ...
1
vote
1answer
37 views

Is a Hash Function really useful in a Smart Contract Election?

Noob here. Was reading this: https://karl.tech/learning-solidity-part-2-voting/ From my basic understanding, a hash function: Receives an input (like x) and spits some result (like y) y is ...
0
votes
1answer
20 views

It is secure do accounts just with web3.eth.accounts.create() ? (entropy)

const Web3 = require('web3'); let url = 'infuralink'; let web3 = new Web3(url); console.log(web3.eth.accounts.create()); This is the code of many tutorials for do a key pair. it is completely secure ...
0
votes
0answers
30 views

How does MetaMask secure / store unlocked accounts?

I understand that MetaMask stores the encrypted vault somewhere like C:\Users\USER_NAME\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn ...
0
votes
0answers
18 views

How do I store or use private keys in node js that I deploy in live server?

I have a live server running a full GETH NODE in which I need to sign a transaction with a private key. The problem is I dont know how I can use the private key without explicitly providing the ...
2
votes
1answer
33 views

Is the May 2017 contract creation attack still possible?

In May 2017, an "attacker" created a contract that attempts to create many other contracts(using many JUMPDEST operations in the creation bytecode) until it runs out of gas. I see the gas ...
0
votes
1answer
27 views

Should Try-Catch error handling be avoided for security? [closed]

What implications can it have to the security of a function if the content of it is wrapped into try-catch statements?
1
vote
1answer
26 views

State only node

Is it possible for the network clients to just keep the latest network state (without keeping track of the past transactions) while not harming the network security? That is, is it really needed to ...
4
votes
1answer
129 views

Underhanded Solidity: Exploiting multiple inheritance

In an article by Steve Marx (on Medium.com), the author argues against using inheritance in solidity not only because of harder readability of a Smart Contract, but also because it can be exploited in ...
0
votes
0answers
12 views

Why can only operators transfer between partitions (ERC1400)?

I came across this line in the ERC1400 implementation (by polymath I believe). if (operatorData.length != 0 && data.length >= 64) { toPartition = _getDestinationPartition(fromPartition,...
0
votes
1answer
53 views

Front-running in Quorum IBFT

Are pending transactions processed sequentially in IBFT? In a networks based on PoW you would usually pay higher gas price in order to get your transaction mined first. Is there a way to manipulate ...
1
vote
1answer
26 views

Scam: Sent ETH to HEX Contract - Where is it?

I sent ETH to the HEX contract, waited for 24 hours to transform and was ready to click "exit" at the end but it just disappeared?
1
vote
1answer
35 views

Can't people be tricked into calling approve on an ERC token contract, and having their tokens stolen?

Most users of Ethereum and ERC tokens probably aren't aware of the existence of the approve and transferFrom functions. Couldn't users unknowingly call approve on an ERC token contract, and ...
0
votes
1answer
44 views

Security flaws in a simple smart contract

I developed a simple smart contract to store two privacy preferences for a user. I am testing and evaluating this contract on a private blockchain via Ganache. I am currently validating the security ...
0
votes
2answers
879 views

How can I change the 12 word phrase in my trust wallet?

I created a ETH trust wallet on my phone for someone and he has now imported the trust wallet to his phone. Is there any way to change the 12 word phrase or somehow give the sole control to the ...
0
votes
1answer
22 views

Changing transaction validation process in Ethereum

I am doing a research about Ethereum smart contracts security. For this purpose I want to make some changes in Ethereum miner and transactions validation process (editing miner for automatically ...
1
vote
1answer
22 views

Is it possible for an interaction between two contracts be interfered with by another contract?

For example: 1.Contract A makes a call to contract B to retrieve a state value from B 2.Contract A then uses the data provided by contract B to create modified value 3.Contract A sends the derived ...
0
votes
1answer
17 views

Is there any other signature mechanism like ECDSA to verify the signed message if its tampered or not?

I would like to know if there are other signature verification methods other than ECDSA, to verify the message (eg., string, number) signed by a signer. Actually if there are alternative algorithms ...
0
votes
1answer
42 views

Does reentrancy attack happens as soon as the balance in storage is modified after the withdrawal?

I just saw something like this: function sub( uint a, uint b ) internal pure returns (uint) { require(b <= a, "SUB_UNDERFLOW"); return a - b; } function withdraw(...
1
vote
1answer
50 views

Who is 0x093a0ed738b65ed34f2a37a2d44c5e3cd0d0dd45?

I was working with ethereum using: - solcjs web3 truffle public no firewall kovan node (parity) and MultiSigWallet.sol from https://github.com/gnosis/MultiSigWallet And when I checked my wallet in ...
0
votes
0answers
18 views

Drizzle Dapp on HTTP vs. HTTPS

If I have a Drizzle dap on an http server. Is there a risk that the private keys used with this dapp can be revealed? I suppose this is like asking if a MetaMask interaction within the unsecure http ...
2
votes
0answers
26 views

Protocol for Response to Ethereum Account Hack [closed]

Last week a single Ethereum account in my wallet was hacked. When I send ETH to it, within 2 blocks the hacker-bot uses my private key and sends 0.0009 ETH to another account and then maxes out the ...
1
vote
3answers
67 views

Is it possible to deploy a contract on the same address after self-destruct?

As far as I understand self-destruct simply deletes the code from a contract and turns it into a regular wallet + it sends all funds to caller/argument. But is there a way to recreate the contract? I ...
1
vote
0answers
59 views

Sending secure transactions using web3.py

An ethereum account I had has been hacked, where whenever I send it, say, 0.1 eth, some evil bot immediately sends 0.0009 eth from that account to a dummy account, and then spends the remaining 0.0991 ...
0
votes
1answer
26 views

Calling transferFrom of external erc20 contract

Hey I'm calling externals contract method transferFrom in following way. function sendTransaction(address tokenAddress, uint tokenAmount) public payable { if (!performTransfer(tokenAddress, ...
0
votes
1answer
37 views

Lottery Winning number based on blockhash

After reading a lot of Info about this topic in this forum I am asking whether I can just use the formular winningNumber = uint256(blockhash(block.number-1)) % 100; e.g. 10 or 20 blocks after the ...
1
vote
1answer
27 views

Information Regarding LASER and Ethereum

I was reading this article https://diligence.consensys.net/files/D1T2%20-%20Bernhard%20Mueller%20-%20Smashing%20Ethereum%20Smart%20Contracts%20for%20Fun%20and%20ACTUAL%20Profit.pdf and came across ...
1
vote
1answer
59 views

Difference between MythX and Mythril for security auditing

I know that both mythrix and mythril are used for smart contracts auditing but I didn't figure out yet the difference between them. I'll appreciate any help.
0
votes
0answers
38 views

what is wrong with this token contract?

This one: https://etherscan.io/address/0xc12d1c73ee7dc3615ba4e37e4abfdbddfa38907e As you can see most of the last transfer fail, the transfer function is: function transfer(address recipient, ...
0
votes
0answers
24 views

Security implications on limiting the round change timeout of Istanbul BFT consensus algorithm?

I have a security-related question regarding the exponentially increasing timeout in the round change, which is used in the Istanbul Byzantine fault-tolerance consensus algorithm used by Quorum. ...
0
votes
0answers
21 views

How to trace transactions to get information about hot and cold wallets?

I am researching ways how to trace transactions to get data about hot and cold wallets of exchanges, gambling sites, cantors, mixers. What sources of data could I use? What algorithms and scripts ...
0
votes
1answer
43 views

Sharing an verifiable secret message in a contract

I would like to hear your opinion on my idea to share a proof of a secret message in a contract, that users can verify later in a second phase when the message will be revealed. If the message is a ...
1
vote
2answers
41 views

How can I find out the sender's gas limit?

Is there a way to check Sender's Gas Limit? If the sender sets too low, I will just accept whatever gas amount that he had set and return immediately without hitting the limit. I am trying to ...
1
vote
2answers
46 views

Is it possible to circumvent a require statement if the ordering of the requirements are incorrect?

Please take the following hypothetical code as an example mapping (address => uint256) public accountBalance; function deposit(uint256 amount) public { accountBalance[msg.sender] = ...
1
vote
1answer
51 views

How does this function potentially violates the Checks-Effects-Interaction pattern?

I am developing a smart contract that integrates with the DAI stable coin. In the function below, you can see that I have followed the check effects interaction pattern, so how come I still get a ...
0
votes
2answers
69 views

How to fight against a cheating node?

As far as I know, there are roughly two kinds of contract calls on Ethereum. One kind is intended to change the global state of blockchain (i.e. change some storage values or transfer money). The ...
1
vote
1answer
58 views

Is it safe to do multiple payments in between locks (Reentrancy Guard)?

https://diligence.consensys.net/blog/2019/09/stop-using-soliditys-transfer-now/ provides a simple example related to using a Reentrancy Guard. Another approach to preventing reentrancy is to ...
3
votes
1answer
403 views

What's the vulnerability in my contract?

I've got a contract deployed at 0xe559835D7979dAe994331DEfaEc2FBA057E56C27 on the mainnet. Every time I go to call the payable function, which is solve, a bot beats me to it. My transaction gets ...
1
vote
1answer
69 views

private key vs seed

I made an extra account in Metamask for my GF, I kept Account 1 for myself and I gave only the private key of Account 2 to my GF. I kept the seed words only to myself. Since then, she has dumped me ...
1
vote
1answer
28 views

Is it considered secure at all to use passwords and private keys in the code of smart contract?

Basically something like: function transfer(address to, string privkey) { if(privkey == "cd33434343...") { msg.sender.transfer(this.balance); } } The above is obviously flawed since the privkey is ...
0
votes
1answer
27 views

Is function like this one reentrant?

Got this in pseudo-code (Solidity like...) from audit of past work of person from our company, in short it seems to be withdrawing first and adding later. Maybe not a good idea, especially since it's ...
1
vote
0answers
23 views

How dangerous is this: number of contracts contain a function like “approveandcall” which lets anyone call any contract (some thoughts?)

The most common implementation is as follows: function approveAndCall(address _spender, uint256 _value, bytes _extraData) public returns (bool success) { tokenRecipient spender = tokenRecipient(...

1
2 3 4 5
11