Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
0
votes
0answers
20 views

Are seed phrases universal?

I was recently using metamask, an ether wallet, when i noticed something weird. Upon installation, I attempted to import an external wallet using a seed phrase. I was told, according to the app, it ...
0
votes
1answer
9 views

How to restrict function to only callable from one external contract?

I have a Reputation contract which has a function foo() that sets some point. In another contract called Market I want to use the foo() function. But I don't want any one to be able to call foo() ...
0
votes
1answer
24 views

Why this delegatecall attack not working?

I am confused by this simple contract. The main purpose is to bypass the OnlyContract() modifier. Victim contract. pragma solidity 0.7.6; contract Victim { modifier OnlyContract() { ...
0
votes
3answers
111 views

hacked from metamask wallet

yesterday 2.3.2021 at 18:25 i was hacked. they stole all my founds from metamusk wallet from my address 0xeD14989682D3770AC0a9AEB2608Aa2315cF312Df and took everything to this address ...
3
votes
2answers
68 views
+100

What if a chain is compromised?

I have deployed a dApp on a sidechain (namely xDai) and am worried about its security. What happens if an EVM chain is compromised? Will it be rolled back after a few hours? or what? If the mainnet is ...
0
votes
1answer
27 views

Authentication between smart contracts based their addresses - Is it safe?

thanks in advance for your time and intellectual contribution. I am working on a project in which we have contracts interacting which each other. More specifically, there is a "father contract&...
0
votes
0answers
35 views

Safe implementation on Solidity 0.8.0 of a withdrawal and a refund

I'm here for asking of a SECURE way to implement on solidity 0.8.0 two functions: 1-Withdrawal() which sends all the ether of the smart contract to the owner address. My current implementation is: //...
1
vote
1answer
48 views

Security implementation of a function in Solidity

I'm here for asking some tips on calling function from other contracts in solidity. Here is the function for generating a random number (which I need in the main contract) using the chainlink VRF. ...
0
votes
1answer
23 views

What is the legitimate use case of using library contract without using contract address?

Let us look at the following contract contract LibraryA { function getSenderAddress() public returns (address); } contract LibraryB { function getSenderAddress() public returns (address);...
2
votes
0answers
56 views

Even if I own 51% of stake (or have 51% computational power) and try to cheat, can't others still see that my block is invalid?

I'm thinking about how proof of stake works exactly. As I understand, here is how it is secure: I cannot forge a tx where random A pays me X amount because I would need the private keys of A. ...
1
vote
0answers
17 views

eip-1967 address calculation

I have read EIP-1967 and i have study how work proxy contracts. There is something i do not understand in EIP-1967. Here is what i have understood: Logic contract's storage variables are stored in ...
0
votes
0answers
13 views

What is the best practice when storing a custodial wallet with node.js and mysql?

I'm using Adonis.js v4 (it's node.js) and mysql (on RDS) as my database. I need to create an ethereum wallet for each of my user's and I need to make transaction on their behalf with their wallet (...
0
votes
0answers
28 views

one wallet address, multiple users, what is the best way to keep the private key secured?

I would like to develop an application using the web3j. However, it needs to be just one wallet that multiple users will deposit and withdraw from. The allowances are kept in a centralized database. ...
0
votes
3answers
46 views

Do view functions cause reentrancy vulnerabulity?

It's well known that calling an external function before changing something in the contract causes a security problem called "reentrancy vulnerability". Does calling an external function ...
0
votes
0answers
18 views

Is it possible for an attacker to exploit contracts that rely on incoming “msg.value”?

I am developing an eth2.0 fuzzer for my masters that has produced some interesting crashes - if these crashes are legitimate I believe I may have found a new vulnerability - otherwise, I still have a ...
0
votes
1answer
17 views

If contracts can be proxied to other contracts, how can a user trust them?

Based on the upgradeable smart contract pattern, a smart contract author can create a contract x that proxies to contract y. Let's say the contract is an ERC20 token where Alice buys 100 tokens. How ...
0
votes
1answer
14 views

Why is sending ETH from multiple accounts in a single transaction deemed a “security hole”?

A user on Ethereum SE posted the following As you noticed, there is no way to send a single from multiple addresses. There is always just one sender. For Ether transfers the Ether value is always ...
3
votes
1answer
133 views

Explain “griefing” attack on Aave flash loan

Aave doc about flash loan warns to never store funds inside a receiver contract as it can be exposed to "griefing" attack. So my questions are Can you give an example of this attack? How ...
1
vote
1answer
57 views

How are Metamask web wallets traceable to owner identity?

When creating a Metamask wallet as a Chrome browser extension, what are all the different identifiers that match the wallet to its owner? Since it takes a password to log into the Metamask wallet, ...
0
votes
2answers
43 views

Can Ethereum wallets be deleted for fraud?

Stellar Foundation, who created the Stellar Lumens coin (XLM), are able to shut down XLM addresses that engage in fraud. Stellar scammers often send small payments to other XLM wallets at random with ...
0
votes
0answers
11 views

Why is serprent considered untrusted?

Serpent was way to fetch Diesel prices from the oraclize api at fixed intervals. On GitHub, it s written audits proved the code to be flawed, but where are such audits? I m meaning why is it flawed?
0
votes
0answers
13 views

About security problem on hard fork named “Spurious Dragon”

What is the specific problem with the secuirty of "Spurious Dragon" (EIP-170)? I've heard that EXTCODESIZE isn't checked when accessing the constructor and doesn't cost a gas fee, but I'm ...
0
votes
0answers
13 views

private network impersonation attack

I've set up a 5-node network with 3 validator nodes. I would like to test the integrity of the blockchain by having a non-validator node attempt to validate a new transaction. How can I go about doing ...
1
vote
1answer
39 views

The security of JSON-RPC

I currently use web3 and geth to develop dapps, and we know that web3 interacts with geth through json rpc. If we want to unlock an account through dapp, we need to enter the password in the dapp, and ...
1
vote
1answer
19 views

How to properly invalidate the manager?

In MyContract, I am providing special rights to the manager. But after some time and for some reason, I want to invalidate the manager. The following is my approach: // SPDX-License-Identifier: GPL-3....
0
votes
1answer
36 views

Deploy basic proxy with arguments

https://github.com/optionality/clone-factory/blob/master/contracts/CloneFactory.sol#L32 contains a code to deploy a basic proxy. This code misses a way to pass data to the proxied contract to init it. ...
1
vote
1answer
45 views

The security problem of tx.origin in Solidity

The book Mastering Ethereum pointed out that it is not safe to use tx.origin in smart contracts. I want to know what is the reason for insecurity?
0
votes
0answers
13 views

Is it possible for miner to tamper with the results when executing smart contracts?

When Miner A executes the smart contract, a result is generated and broadcast to the entire network. I want to know if this result may have been tampered with. If this is possible, how do other miners ...
0
votes
1answer
34 views

The security of private key with geth on the server-side

If you initiate a transaction in real time, you need to store the private key on the geth server to initiate the transaction. Once the geth server is hacked, the private key may be leaked. Is there ...
1
vote
1answer
43 views

Can the Geth password be cracked

When we create a new user in Geth, we need to enter a password. When initiating transactions in the future, you also need to use this password to unlock the account first. I want to know where the ...
0
votes
0answers
12 views

When calling eth_getLogs, should I worry if a block is mined?

I call eth_getLogs to store some data in the database. In https://eth.wiki/json-rpc/API#eth_getLogs it says: fromBlock: QUANTITY|TAG - (optional, default: "latest") Integer block number, or &...
1
vote
1answer
14 views

Is it okay to store your private key on Ubuntu server in .env?

Lets say you have to sign transactions / messages real-time. It seems I must store the private key in the server. What if the address stores millions of dollars of value? Is simple LEMP server enough ...
0
votes
2answers
18 views

Existing research about m-of-n paper seed phrases

I'm interested in designing a protocol that stores a seed phrase for a crypto wallet across N separate pieces of paper (or metal!), where any M of the pieces of paper can reconstruct the seed phrase, ...
1
vote
1answer
28 views

Reentrancy protection against multiple entries at once

I'm concerned about the security of the Reentrancy pattern that we can use in Solidity to prevent from calling multiple times a same function at the same time. This protection is nicely implemented ...
1
vote
0answers
51 views

What s the fake deposit attack affecting some exchanges with erc20?

There are a lot of articles about hacked tokens affecting centralized exchanges only when Googling fake erc20 deposit but I failed to find a reference describing how the attack works technically. The ...
0
votes
0answers
31 views

How can I have no gas fees in a private PoA network while avoiding spam attacks and the halting problem?

Complete noob here. I'm developing a dApp that functions on top of a private clique PoA blockchain (using geth). The project should be viable in a production environment and allow nodes to transact ...
1
vote
0answers
77 views

Flash minting ether security considerations and attacks

Flash loans enable a class of attacks that have not been possible or observed as much in prior systems. Flash minting ether is a concept that is starting to be implemented. See Example of flash ...
8
votes
4answers
664 views

Flash loan security considerations and attacks

What do developers need to be aware of to make their contracts and systems safe against flash loans? What do they have to think about and protect against?
0
votes
1answer
57 views

Is it bad idea to store my passwords on blockchain with a smart contract?

I want to save my passwords and some other personal data on a ethereum like blockchain. it seems more persistant to me. I may lose my e-mail , my pc may crush and I may lose my usb stick. But nothing ...
0
votes
0answers
22 views

Is it bad idea to store my passwords on blockchain with a smart contract? [duplicate]

I want to save my passwords and some other personal data on a ethereum like blockchain. it seems more persistant to me. I may lose my e-mail , my pc may crush and I may lose my usb stick. But nothing ...
0
votes
0answers
22 views

How to work with MythX in a Truffle project to analyze a contract?

I work with Truffle and Windows Powershell. I have a smart contract. Now, I want to analyze the contract's security with Mythx. For that, I installed pip3 to install MythX CLI after that. Now, I have ...
0
votes
1answer
28 views

An attack to my contract similar to ERC-20 approval() exploit

I have function setNonRecurringFlow(uint256 _child, int256 _remainingSwapCredit) external; function setRecurringFlow( uint256 _child, int256 _maxSwapCredit, int256 ...
0
votes
1answer
23 views

Need to execute several transactions as fast as possible

In the case of an emergency (e.g. theft), it may be necessary to disable several accounts as fast as possible. I am writing the smart contract. Should each of several accounts be disabled in a ...
0
votes
0answers
10 views

How do two parties verify a transaction initially?

Sorry for the beginner question. Im trying to understand how a blockchain transaction is initially verified by both parties. I think I understand the process of externally verifying a transaction but ...
0
votes
0answers
24 views

_transferFrom vs. _burnFrom order of operations (Zeppelin ERC20burnable.sol)

I have question, more for my understanding than anything. Here’s the transferFrom function in the ERC20 standard: function transferFrom(address sender, address recipient, uint256 amount) public ...
0
votes
0answers
33 views

Proof-of-Stake: How to prevent someone from being always selected as an author of block? [duplicate]

In proof-of-stake, by definition, each stakeholder deposits and locks some tokens (stakes) for more chances to be selected as an author of block in a random-based election procedure. Till here, it's ...
2
votes
1answer
40 views

Is there a way to verify transactions afterwards they are entered in the ethereum blockchain?

Suppose I sent a signed transaction using the web3.js library. But, I might be using some third party API like an Infura node or others. So there are chances of attacks and data manipulation. So, is ...
0
votes
1answer
23 views

How is transferFrom secure?

function transferFrom(address sender, address recipient, uint256 amount) public virtual override returns (bool) { _transfer(sender, recipient, amount); _approve(sender, _msgSender(), ...
0
votes
1answer
14 views

Token Restrictions Helping me Understand Blockchain Logic

To execute the transfer or transferFrom ERC-20 token functions in a Solidity contract, ie: // moves token from contract to personal address ERC20Token.transfer(msg.sender, tokenamount); // ...
1
vote
1answer
12 views

If you're a node, why would you accept other node's solution instead of copying and broadcasting that solution?

Let's say someone broadcasted a solution to the recent block. Why, as a node, would I accept it? I can just copy and broadcast it myself instead. Yes, most of the times the first node would win, but ...

1
2 3 4 5
12