Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
0
votes
1answer
12 views

The security of private key with geth on the server-side

If you initiate a transaction in real time, you need to store the private key on the geth server to initiate the transaction. Once the geth server is hacked, the private key may be leaked. Is there ...
1
vote
1answer
15 views

Can the Geth password be cracked

When we create a new user in Geth, we need to enter a password. When initiating transactions in the future, you also need to use this password to unlock the account first. I want to know where the ...
0
votes
0answers
19 views

the security of nodes in private chain

I implemented a private chain, and now there are some nodes on the chain. I want to use these nodes to call a smart contract to vote. My question now is how to ensure the security of the nodes on ...
0
votes
0answers
9 views

When calling eth_getLogs, should I worry if a block is mined?

I call eth_getLogs to store some data in the database. In https://eth.wiki/json-rpc/API#eth_getLogs it says: fromBlock: QUANTITY|TAG - (optional, default: "latest") Integer block number, or &...
1
vote
1answer
12 views

Is it okay to store your private key on Ubuntu server in .env?

Lets say you have to sign transactions / messages real-time. It seems I must store the private key in the server. What if the address stores millions of dollars of value? Is simple LEMP server enough ...
0
votes
2answers
14 views

Existing research about m-of-n paper seed phrases

I'm interested in designing a protocol that stores a seed phrase for a crypto wallet across N separate pieces of paper (or metal!), where any M of the pieces of paper can reconstruct the seed phrase, ...
1
vote
1answer
19 views

Reentrancy protection against multiple entries at once

I'm concerned about the security of the Reentrancy pattern that we can use in Solidity to prevent from calling multiple times a same function at the same time. This protection is nicely implemented ...
1
vote
0answers
26 views

What s the fake deposit attack affecting some exchanges with erc20?

There are a lot of articles about hacked tokens affecting centralized exchanges only when Googling fake erc20 deposit but I failed to find a reference describing how the attack works technically. The ...
0
votes
0answers
19 views

How can I have no gas fees in a private PoA network while avoiding spam attacks and the halting problem?

Complete noob here. I'm developing a dApp that functions on top of a private clique PoA blockchain (using geth). The project should be viable in a production environment and allow nodes to transact ...
1
vote
0answers
47 views

Flash minting ether security considerations and attacks

Flash loans enable a class of attacks that have not been possible or observed as much in prior systems. Flash minting ether is a concept that is starting to be implemented. See Example of flash ...
8
votes
4answers
433 views

Flash loan security considerations and attacks

What do developers need to be aware of to make their contracts and systems safe against flash loans? What do they have to think about and protect against?
0
votes
1answer
37 views

Is it bad idea to store my passwords on blockchain with a smart contract?

I want to save my passwords and some other personal data on a ethereum like blockchain. it seems more persistant to me. I may lose my e-mail , my pc may crush and I may lose my usb stick. But nothing ...
0
votes
0answers
22 views

Is it bad idea to store my passwords on blockchain with a smart contract? [duplicate]

I want to save my passwords and some other personal data on a ethereum like blockchain. it seems more persistant to me. I may lose my e-mail , my pc may crush and I may lose my usb stick. But nothing ...
0
votes
0answers
15 views

How to work with MythX in a Truffle project to analyze a contract?

I work with Truffle and Windows Powershell. I have a smart contract. Now, I want to analyze the contract's security with Mythx. For that, I installed pip3 to install MythX CLI after that. Now, I have ...
0
votes
1answer
18 views

An attack to my contract similar to ERC-20 approval() exploit

I have function setNonRecurringFlow(uint256 _child, int256 _remainingSwapCredit) external; function setRecurringFlow( uint256 _child, int256 _maxSwapCredit, int256 ...
0
votes
1answer
19 views

Need to execute several transactions as fast as possible

In the case of an emergency (e.g. theft), it may be necessary to disable several accounts as fast as possible. I am writing the smart contract. Should each of several accounts be disabled in a ...
0
votes
0answers
10 views

How do two parties verify a transaction initially?

Sorry for the beginner question. Im trying to understand how a blockchain transaction is initially verified by both parties. I think I understand the process of externally verifying a transaction but ...
0
votes
0answers
20 views

_transferFrom vs. _burnFrom order of operations (Zeppelin ERC20burnable.sol)

I have question, more for my understanding than anything. Here’s the transferFrom function in the ERC20 standard: function transferFrom(address sender, address recipient, uint256 amount) public ...
0
votes
0answers
33 views

Proof-of-Stake: How to prevent someone from being always selected as an author of block? [duplicate]

In proof-of-stake, by definition, each stakeholder deposits and locks some tokens (stakes) for more chances to be selected as an author of block in a random-based election procedure. Till here, it's ...
2
votes
1answer
39 views

Is there a way to verify transactions afterwards they are entered in the ethereum blockchain?

Suppose I sent a signed transaction using the web3.js library. But, I might be using some third party API like an Infura node or others. So there are chances of attacks and data manipulation. So, is ...
0
votes
1answer
22 views

How is transferFrom secure?

function transferFrom(address sender, address recipient, uint256 amount) public virtual override returns (bool) { _transfer(sender, recipient, amount); _approve(sender, _msgSender(), ...
0
votes
1answer
14 views

Token Restrictions Helping me Understand Blockchain Logic

To execute the transfer or transferFrom ERC-20 token functions in a Solidity contract, ie: // moves token from contract to personal address ERC20Token.transfer(msg.sender, tokenamount); // ...
1
vote
1answer
11 views

If you're a node, why would you accept other node's solution instead of copying and broadcasting that solution?

Let's say someone broadcasted a solution to the recent block. Why, as a node, would I accept it? I can just copy and broadcast it myself instead. Yes, most of the times the first node would win, but ...
2
votes
0answers
309 views

Frontrunning Uniswap horror story transactions

From the Ethereum is a Dark Forest post, the rescue plan was: Deploy a Getter contract which, when called by its owner, would make the burn call ONLY if activated, and otherwise revert. Deploy a ...
0
votes
0answers
18 views

Avoiding contract impersonation

Newbie question. Suppose I have contract X which have a foo function which accepts contract of type Y and calls function bar on it like this. contract Y { function bar() public; } contract X { ...
1
vote
0answers
19 views

Is there any free-to-use scenario builder?

The Compound Protocol has a collection of high-level integration tests, dubbed "scenarios": https://github.com/compound-finance/compound-protocol/tree/v2.8.1/spec Which look like this: Test &...
1
vote
2answers
32 views

How does proof of stake prevent past blocks from being changed?

I have a question about Proof of Stake. Are there any protections against a user just creating an entirely new chain, since there is no computational penalty for creating a really long chain, couldn't ...
1
vote
0answers
18 views

Difference between SMTChecker and Manticore?

Why would I use Trail of Bits' Manticore over SMTChecker, which is baked in the Solidity compiler?
1
vote
0answers
39 views

msg.sender and tx.origin - how to use them in practice? [duplicate]

I wrote a contract A that uses msg.sender for authentication: When A creates an item it stores msg.sender in itemsOwners mapping (itemOwners[itemId] = msg.sender;). Later A compares msg.sender to ...
1
vote
0answers
18 views

Cost of forking Augur

Augur Version 2 is scheduled for launch on July 28th 2020. How can the cost of forking Augur version 2 (by disputing a market resolution) be calculated in REP? How dies this cost compare to the cost ...
0
votes
0answers
12 views

Suggest solution and/or literature on secure distributed voting

I'm a complete noob when it comes to blockchains and cryptocurrencies, but I am quite skilled with math and CS, so hopefully I am able to ask the correct questions and understand the answers For a ...
0
votes
1answer
42 views

Can someone read this private variable?

my purpose is to generate a random key when the smart contract is created and save that key in a private variable. I don't what to know its value either. Let's take for example the code below: pragma ...
0
votes
1answer
38 views

How can I prove my friend having changed just one word in the seed and have it lay around is super insecure?

My friend said to me that he has his seed saved in Google Drive and that he is absolutely safe even if someone found it out. He even gave me his seed to try to break it. I know that all I have to do ...
0
votes
0answers
21 views

Validating transactions with ZK methods

After reading some topics on the implementation of ZK methods in the Ethereum, how would this affect the PoW? Please have someone correct me if I am wrong (I started recently), but if the nodes need ...
0
votes
2answers
52 views

Sending extra data beside or inside a new smart contract

I'm doing a research about Ethereum smart contracts security and I need to send some extra data (for example some json data) beside or inside a new smart contract when I'm deploying that contract on ...
1
vote
1answer
45 views

Is a Hash Function really useful in a Smart Contract Election?

Noob here. Was reading this: https://karl.tech/learning-solidity-part-2-voting/ From my basic understanding, a hash function: Receives an input (like x) and spits some result (like y) y is ...
0
votes
1answer
28 views

It is secure do accounts just with web3.eth.accounts.create() ? (entropy)

const Web3 = require('web3'); let url = 'infuralink'; let web3 = new Web3(url); console.log(web3.eth.accounts.create()); This is the code of many tutorials for do a key pair. it is completely secure ...
1
vote
0answers
55 views

How does MetaMask secure / store unlocked accounts?

I understand that MetaMask stores the encrypted vault somewhere like C:\Users\USER_NAME\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn ...
0
votes
0answers
25 views

How do I store or use private keys in node js that I deploy in live server?

I have a live server running a full GETH NODE in which I need to sign a transaction with a private key. The problem is I dont know how I can use the private key without explicitly providing the ...
2
votes
1answer
35 views

Is the May 2017 contract creation attack still possible?

In May 2017, an "attacker" created a contract that attempts to create many other contracts(using many JUMPDEST operations in the creation bytecode) until it runs out of gas. I see the gas ...
0
votes
1answer
30 views

Should Try-Catch error handling be avoided for security? [closed]

What implications can it have to the security of a function if the content of it is wrapped into try-catch statements?
1
vote
1answer
29 views

State only node

Is it possible for the network clients to just keep the latest network state (without keeping track of the past transactions) while not harming the network security? That is, is it really needed to ...
4
votes
1answer
140 views

Underhanded Solidity: Exploiting multiple inheritance

In an article by Steve Marx (on Medium.com), the author argues against using inheritance in solidity not only because of harder readability of a Smart Contract, but also because it can be exploited in ...
0
votes
0answers
16 views

Why can only operators transfer between partitions (ERC1400)?

I came across this line in the ERC1400 implementation (by polymath I believe). if (operatorData.length != 0 && data.length >= 64) { toPartition = _getDestinationPartition(fromPartition,...
0
votes
1answer
59 views

Front-running in Quorum IBFT

Are pending transactions processed sequentially in IBFT? In a networks based on PoW you would usually pay higher gas price in order to get your transaction mined first. Is there a way to manipulate ...
1
vote
1answer
29 views

Scam: Sent ETH to HEX Contract - Where is it?

I sent ETH to the HEX contract, waited for 24 hours to transform and was ready to click "exit" at the end but it just disappeared?
1
vote
1answer
50 views

Can't people be tricked into calling approve on an ERC token contract, and having their tokens stolen?

Most users of Ethereum and ERC tokens probably aren't aware of the existence of the approve and transferFrom functions. Couldn't users unknowingly call approve on an ERC token contract, and ...
0
votes
1answer
47 views

Security flaws in a simple smart contract

I developed a simple smart contract to store two privacy preferences for a user. I am testing and evaluating this contract on a private blockchain via Ganache. I am currently validating the security ...
0
votes
2answers
2k views

How can I change the 12 word phrase in my trust wallet?

I created a ETH trust wallet on my phone for someone and he has now imported the trust wallet to his phone. Is there any way to change the 12 word phrase or somehow give the sole control to the ...
0
votes
1answer
27 views

Changing transaction validation process in Ethereum

I am doing a research about Ethereum smart contracts security. For this purpose I want to make some changes in Ethereum miner and transactions validation process (editing miner for automatically ...

1
2 3 4 5
12