Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
0 votes
0 answers
12 views

Geth Private Network - Account management

I'm building a private blockchain using Geth. I created 2 accounts with command geth --datadir miner-node account new and geth --datadir rpc-node account new, then I added their address to genesis....
revSurfer's user avatar
0 votes
0 answers
13 views

Is everything okay with this Presale contract?

Could you help me check if this presale contract does what it's supposed to do and if it's safe? I tried to find bugs or flaws but couldn't find anything. The theory is very simple: the user can use ...
Integral's user avatar
  • 115
0 votes
2 answers
37 views

Is it possible to manipulate V2 getAmountOut() or V3 sqrtPriceX96 using Uniswap flash swaps or any kind of flash loan

I use this calls: IUniswapV2Router(uniswapV2Router).getAmountOut(tokenAmount, reserve1, reserve0) // Uniswap V2 token price (uint160 sqrtPriceX96, , , , , , ) = uniswapV3Pool.slot0(); // Uniswap V3 ...
blockson's user avatar
0 votes
0 answers
25 views

Token Transfer in the absence of _isApprovedOrOwner

I have created a smart contract in which I have a method called forSale used to store a flag (in a struct part of a mapping) indicating that the owner of an ERC721 token wishes to sell his said token (...
JF0001's user avatar
  • 281
0 votes
0 answers
30 views

Adding liquidity for honeypot scam tokens

I have bought into my share of honeypot scam tokens over the years. I am not sore about it - I accept it as an 'operating cost' of trading in risky tokens. But I was curious whether I could take these ...
obenihk's user avatar
0 votes
0 answers
18 views

Geth private network security

I'm implementing a private network with Geth, which is expected to go into production for a client. What are the most important points to focus on regarding the security of my blockchain? I was ...
revSurfer's user avatar
0 votes
0 answers
7 views

How to record proof of contract exploit on-chain?

Suppose one want to insure from certain contract hacks. Do do that in non custodial manner, we need some way to detect hack on-chain. I see some obvious ideas, like "if one wallet stores more ...
uhbif19's user avatar
  • 101
0 votes
0 answers
13 views

Eth_sign, blind singing and MM signing

Having some confusion on what is what here. Is there difference in enabling eth_sign in metamask with blind signing on ledger? Many web3 sites today require user to sign message as log in method. I ...
Blissful's user avatar
  • 382
1 vote
1 answer
33 views

Reentrancy Guard and CEI

Could you please explain, is there a need to use a ReentrancyGuard modifier if the contract follows the CEI(Check Effect Interactions) pattern? If yes, could you bring an example, where the contract ...
Mark's user avatar
  • 13
0 votes
1 answer
61 views

Permit and transferFrom function called on an ERC20 which drained a specific token in my wallet

I recently found out I've been drained of around 1600 $ALT tokens in two separate transactions a few days ago. It sucks to lose money, but it sucks even more if you never know how it happened and what ...
Meysam's user avatar
  • 3
2 votes
1 answer
114 views

Where does Metamask store the private key (when the account is only locked with a machine-specific password)?

Where does Metamask store the private keys of an EVM-account after one recovers an account with private keys? Does it cipher the private keys before writing to storage, e.g. encoding with the access ...
Mila A's user avatar
  • 1,179
0 votes
0 answers
10 views

How to use ethereum on decentralized exchanges in the US?

See https://www.reddit.com/r/Bitcoin/comments/145yka4/comment/jnoduy1/?utm_source=share&utm_medium=web2x&context=3 Dex's don't deal with Fiat directly, you always need a cex to buy your ...
Ralph Yozzo's user avatar
0 votes
0 answers
5 views

Implement a secure communication mechanism between the smart contract and the client."

I'm developing a dapp to allow users to chat with each other. The problem is that I need to ensure the security of the transmitted messages. What mechanism can be used to make the communication ...
grn.1002's user avatar
0 votes
1 answer
21 views

I get blackmailed by a person from which I have only the Etherium wallet adress [duplicate]

I need help to identify a person that is blackmailing with what she thinks is compromising material, to send it to family, colleagues, etc etc, if I do not pay 300 € (as a start) to settle the issue. ...
Matthias's user avatar
1 vote
0 answers
282 views

What are examples of high-liquidity ERC777 tokens on ETHEREUM? Any other token standards apply too, as long as there's a beforeTransfer callback

I'm looking to make a list of popular tokens that implement hooks on transferFrom(address owner, address receiver, uint256 amount) and are deployed on the Ethereum blockchain in particular. For ...
Mila A's user avatar
  • 1,179
0 votes
1 answer
107 views

New Metamask account randomly sending funds to another wallet

I made a new secondary account under my wallet and immediately transferred funds to it through Coinbase exchange. In less than 4 mins, the new account made a random unauthorized transfer to a random ...
heng heng's user avatar
0 votes
1 answer
17 views

Ethernaut Alien Codex Gas Estimation Failed

When i call attack() or exploit() function the remix shows Gas Estimation Failed. The code is copied from existing solution available on internet. so code is correct, can someone please help me why I ...
Shubham's user avatar
  • 25
1 vote
1 answer
154 views

backend based signature verification

I'm new in web3 and I'm trying to develop a way to authenticate users in my dapp. I'm used to using the old and safe method with email + password to do that, but recently I realised that I could use ...
whoami's user avatar
  • 13
0 votes
0 answers
16 views

Learning to test

I am currently learning how to test SC with foundry and I feel with each different contract that I test that I really don't learn anything, any study recommendations?
David Antunez's user avatar
1 vote
1 answer
51 views

Understanding Reentrancy attacks

I'm trying to understand the mechanism for a reentrancy attack, and how it might be mitigated. I'm looking at (for example) this scan result: https://de.fi/scanner/contract/...
Abraham P's user avatar
  • 103
1 vote
2 answers
36 views

Audit Vulnerability Findings

As a person who is interested in smart contract auditing but have never done before I have this question in my head. What if an auditor finds a lets say critical vulnerability which will enable him to ...
qursk's user avatar
  • 13
3 votes
0 answers
69 views

BLS signatures and the Splitting Zero attack

In 2021 security researcher Quan Thoi Minh Nguyen published two papers ("0" and "Attacks and weaknesses of BLS aggregate signatures") where he highlighted some security weaknesses ...
BrainGrind's user avatar
0 votes
0 answers
20 views

Purposely failing Low-Level Call

Does this code below have a vulnerability? burnAddress.call.value(msg.value)(""); //update state burn Address is a trusted contract, which ...
Pramoxlol's user avatar
0 votes
1 answer
65 views

Are multiplications after division UNSAFE?

I have a smart contract which essentially does this: uint256 tokenRate = _pair.a2 * PRECISION_FACTOR / _pair.a1; uint256 toSend = _amount * tokenRate / PRECISION_FACTOR; uint256 feeToOwner2 = toSend ...
Iulian's user avatar
  • 640
1 vote
1 answer
24 views

How prevent of attack in Ethereum

I hope you are well. The topic of my thesis is to increase security in blockchain-based IoMT (Internet of Medical Things). I aim to present new ideas to reduce attacks in the blockchain, considering ...
Samaneh's user avatar
  • 11
2 votes
1 answer
46 views

Is there a way to stop wallet homomorph attacks without ditching the create2 opcode?

Losses from create2 wallets that look similar to recently active wallets has surpassed $60m: https://gbhackers.com/create2-bypass-wallet-security-alerts/ Even today I made a transaction, and noticed ...
rook's user avatar
  • 141
0 votes
0 answers
11 views

Would this work to add a check that a signature hasn't already been used?

I'm working on an exercise to learn smart contract security, and I am trying to add a check that a signature has not been previously used to this withdraw function. Below I put the original function ...
user127148's user avatar
2 votes
1 answer
16 views

Is it profitable for a miner to manipulate blocks in a small Ethereum project?

In the context of my blockchain project, I’m using the blockhash() function to generate randomness. However, I’m concerned about the potential vulnerability of this method. I’d like to know if, in a ...
Vlad's user avatar
  • 21
0 votes
0 answers
4 views

Data Based and System Security

Over the last year or so, ever since I started messing around with the blockchain protocol, I my system, database, seems to have gotten hacked time and time again. I have learned a great deal with ...
Scott-Group's user avatar
0 votes
1 answer
208 views

How to download and install Echidna?

I have just started learning echidna but i havent found any detailed information of how to install and setup echidna in WSL.
kumar's user avatar
  • 61
1 vote
1 answer
161 views

What is "pig butchering" scam?

What is the "pig butchering" scam? Why is it called "pig butchering"? What are some of its elements? How bad can it get?
eth's user avatar
  • 85.8k
0 votes
1 answer
43 views

To what extent was the block hash malleable under proof-of-work?

To emphasise, I’m solely interested in blocks prior to the transition to PoS. Given that a miner making any change to the block header would have resulted in a completely different hash, my thinking ...
user72364's user avatar
  • 135
1 vote
2 answers
1k views

Can your Metamask get hacked by signing a message, no gas?

If I log into a new project with Metamask, and the operation costs no gas, can I get hacked? Does no gas mean you are safe when signing with Metamask?
kintsukuroi's user avatar
1 vote
0 answers
46 views

Creating a sufficiently random number via computation entropy without an oracle

I am creating a token that requires a sufficiently random number for an internal lottery. uint randomX; function semirandomize(uint prevRandom, uint time) private view returns (uint) { ...
Ashraile's user avatar
  • 125
0 votes
2 answers
184 views

ERC20 token smart contract check

I updated my smart contract code according to the explanations you gave and the instructions you gave. Please, if possible, check the rewritten code again and give your general opinion, is this smart ...
Ali's user avatar
  • 63
0 votes
1 answer
27 views

Use offchain date time

in my contract, I need to do something based on time, and this is quite sensitive, and as we know, you cannot rely on the block.timestamp because it can be changed, I want to know if there is a way ...
Mehran Ra's user avatar
  • 590
1 vote
1 answer
47 views

Is it secure to use multiple admin

im trying to do multiple admin system in my solidity and here is example //SPDX-License-Identif`ier: MIT pragma solidity 0.8.15; import "@openzeppelin/contracts/access/Ownable.sol"; ...
Mert Tanıtan's user avatar
1 vote
1 answer
52 views

Building Cryptocurrency Tracking system for monitoring stolen cryptocurrency transactions

When hackers steal tokens from an account, what they generally do is divert the flow of tokens via multiple proxy accounts making it complicated for the cyber-forensics department to track final ...
Rohit Jambhulkar's user avatar
1 vote
0 answers
61 views

How to run a script which requires a private key completely in a browser?

For a non-technical person I need to create a page on my website, in the admin area, in which he'd regularly do stuff that normally is done on local machine only. That is, a person doesn't want to go ...
Nondi's user avatar
  • 49
0 votes
0 answers
59 views

Connect & interact with dApp without wallet connection

I have a question regarding the issues I am facing on my current project. I am building NFT marketplace on the Polygon network. The specific requirement is we should allow the users can interact with ...
legendary's user avatar
0 votes
2 answers
57 views

What are the best up-to-date secure approaches of generating pseudorandom number in Solidity? [duplicate]

I am thinking about creating a lottery with more than one winner and one round for users. Please don't consider usual 'commit-reveal' scheme. However, person can claim rewards on their own at the end ...
Victor's user avatar
  • 13
0 votes
1 answer
43 views

What is an re-entrancy attack and how does it work?

With the recent exploit on the omnipools on Conic Finance. The hacker used an exploit called: re-entrancy attack. How does it work explained in layman terms? And what should smart contract auditors ...
Patoshi パトシ's user avatar
14 votes
1 answer
6k views

I got scammed or suspect scam on Ethereum. What to do?

This is a general question and answer on ethereum.stackexchange.com to all "I got scammed, please help" posts. This applies to you if you think: You have been scammed You think something ...
Mikko Ohtamaa's user avatar
1 vote
1 answer
145 views

What are the possible security threats when using mappings in Solidity?

Does the use of a nested mapping possess any threats to the security of the contract below? contract Users { struct User { address payable regAddress; uint64 timestamp; ...
Mila A's user avatar
  • 1,179
1 vote
0 answers
68 views

How to prevent replay attacks on ZK Proof Transactions?

Alice wants to prove a statement (let's say, she has a secret value x such that x * 2 = 10) to Bob without revealing x). Alice generates a proof using the ZK-Snark protocol. const { proof, ...
lordarora's user avatar
  • 296
1 vote
2 answers
344 views

Which of <= and < comparison operators use less gas in Solidity?

if(num <= 10) revert(); And if(num < 11) revert(); Which of these statements consume less gas? If we could save gas, we need not use less than/greater than equal to. We can just use less than ...
Pankaj Jagtap's user avatar
0 votes
1 answer
644 views

My coins were sent from my metamask wallet to another wallet without my consent

I just claimed tokens after a presale had ended from the token site to my metamask wallet. That transaction was successful. However, just one minute after that transaction took place, my coins were ...
john prasitsak's user avatar
0 votes
1 answer
49 views

Another contract is intercepting my contract calls and stealing the funds, what can it be?

This is the code I have, and I deployed to polygon mainnet to test. https://polygonscan.com/address/0x3CC3F39cc2386a8847378F4022917B3bB623BAFD // SPDX-License-Identifier: MIT // An example of a ...
Tsss's user avatar
  • 1
2 votes
1 answer
92 views

Can `msg.value` be trusted to remain the same after an external call?

Can msg.value be trusted to remain the same after the weth.deposit call in the foo function? pragma solidity >=0.8.19; interface WETHLike { function balanceOf(address account) external view ...
Paul Razvan Berg's user avatar
2 votes
1 answer
95 views

QuickAlerts Help!

I have been using QuickAlerts to track activities on my smart contract and receive a WebHook in my Discord server. How can I make sure that the WebHook is indeed coming from QuickAlerts and not a ...
Tien's user avatar
  • 193

1
2 3 4 5
18