Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
0 votes
1 answer
18 views

Are multiplications after division UNSAFE?

I have a smart contract which essentially does this: uint256 tokenRate = _pair.a2 * PRECISION_FACTOR / _pair.a1; uint256 toSend = _amount * tokenRate / PRECISION_FACTOR; uint256 feeToOwner2 = toSend ...
Iulian's user avatar
  • 640
1 vote
1 answer
18 views

How prevent of attack in Ethereum

I hope you are well. The topic of my thesis is to increase security in blockchain-based IoMT (Internet of Medical Things). I aim to present new ideas to reduce attacks in the blockchain, considering ...
Samaneh's user avatar
  • 11
2 votes
1 answer
36 views

Is there a way to stop wallet homomorph attacks without ditching the create2 opcode?

Losses from create2 wallets that look similar to recently active wallets has surpassed $60m: https://gbhackers.com/create2-bypass-wallet-security-alerts/ Even today I made a transaction, and noticed ...
rook's user avatar
  • 141
0 votes
0 answers
6 views

Would this work to add a check that a signature hasn't already been used?

I'm working on an exercise to learn smart contract security, and I am trying to add a check that a signature has not been previously used to this withdraw function. Below I put the original function ...
user127148's user avatar
2 votes
1 answer
14 views

Is it profitable for a miner to manipulate blocks in a small Ethereum project?

In the context of my blockchain project, I’m using the blockhash() function to generate randomness. However, I’m concerned about the potential vulnerability of this method. I’d like to know if, in a ...
Vlad's user avatar
  • 21
0 votes
0 answers
4 views

Data Based and System Security

Over the last year or so, ever since I started messing around with the blockchain protocol, I my system, database, seems to have gotten hacked time and time again. I have learned a great deal with ...
Scott-Group's user avatar
0 votes
1 answer
43 views

How to download and install Echidna?

I have just started learning echidna but i havent found any detailed information of how to install and setup echidna in WSL.
kumar's user avatar
  • 41
0 votes
1 answer
59 views

What is "pig butchering" scam?

What is the "pig butchering" scam? Why is it called "pig butchering"? What are some of its elements? How bad can it get?
eth's user avatar
  • 85.1k
0 votes
1 answer
42 views

To what extent was the block hash malleable under proof-of-work?

To emphasise, I’m solely interested in blocks prior to the transition to PoS. Given that a miner making any change to the block header would have resulted in a completely different hash, my thinking ...
user72364's user avatar
  • 135
1 vote
2 answers
131 views

Can your Metamask get hacked by signing a message, no gas?

If I log into a new project with Metamask, and the operation costs no gas, can I get hacked? Does no gas mean you are safe when signing with Metamask?
kintsukuroi's user avatar
1 vote
0 answers
38 views

Creating a sufficiently random number via computation entropy without an oracle

I am creating a token that requires a sufficiently random number for an internal lottery. uint randomX; function semirandomize(uint prevRandom, uint time) private view returns (uint) { ...
Ashraile's user avatar
0 votes
2 answers
92 views

ERC20 token smart contract check

I updated my smart contract code according to the explanations you gave and the instructions you gave. Please, if possible, check the rewritten code again and give your general opinion, is this smart ...
Ali's user avatar
  • 63
0 votes
1 answer
22 views

Use offchain date time

in my contract, I need to do something based on time, and this is quite sensitive, and as we know, you cannot rely on the block.timestamp because it can be changed, I want to know if there is a way ...
Mehran Ra's user avatar
  • 481
1 vote
1 answer
30 views

Is it secure to use multiple admin

im trying to do multiple admin system in my solidity and here is example //SPDX-License-Identif`ier: MIT pragma solidity 0.8.15; import "@openzeppelin/contracts/access/Ownable.sol"; ...
Mert Tanıtan's user avatar
1 vote
1 answer
36 views

Building Cryptocurrency Tracking system for monitoring stolen cryptocurrency transactions

When hackers steal tokens from an account, what they generally do is divert the flow of tokens via multiple proxy accounts making it complicated for the cyber-forensics department to track final ...
Rohit Jambhulkar's user avatar
1 vote
0 answers
33 views

How to run a script which requires a private key completely in a browser?

For a non-technical person I need to create a page on my website, in the admin area, in which he'd regularly do stuff that normally is done on local machine only. That is, a person doesn't want to go ...
Nondi's user avatar
  • 49
0 votes
0 answers
28 views

Connect & interact with dApp without wallet connection

I have a question regarding the issues I am facing on my current project. I am building NFT marketplace on the Polygon network. The specific requirement is we should allow the users can interact with ...
legendary's user avatar
0 votes
2 answers
42 views

What are the best up-to-date secure approaches of generating pseudorandom number in Solidity? [duplicate]

I am thinking about creating a lottery with more than one winner and one round for users. Please don't consider usual 'commit-reveal' scheme. However, person can claim rewards on their own at the end ...
Victor's user avatar
  • 13
0 votes
1 answer
30 views

What is an re-entrancy attack and how does it work?

With the recent exploit on the omnipools on Conic Finance. The hacker used an exploit called: re-entrancy attack. How does it work explained in layman terms? And what should smart contract auditors ...
Patoshi パトシ's user avatar
12 votes
1 answer
2k views

I got scammed or suspect scam on Ethereum. What to do?

This is a general question and answer on ethereum.stackexchange.com to all "I got scammed, please help" posts. This applies to you if you think: You have been scammed You think something ...
Mikko Ohtamaa's user avatar
1 vote
1 answer
105 views

What are the possible security threats when using mappings in Solidity?

Does the use of a nested mapping possess any threats to the security of the contract below? contract Users { struct User { address payable regAddress; uint64 timestamp; ...
Mila A's user avatar
  • 264
1 vote
0 answers
46 views

How to prevent replay attacks on ZK Proof Transactions?

Alice wants to prove a statement (let's say, she has a secret value x such that x * 2 = 10) to Bob without revealing x). Alice generates a proof using the ZK-Snark protocol. const { proof, ...
lordarora's user avatar
  • 296
1 vote
2 answers
210 views

Which of <= and < comparison operators use less gas in Solidity?

if(num <= 10) revert(); And if(num < 11) revert(); Which of these statements consume less gas? If we could save gas, we need not use less than/greater than equal to. We can just use less than ...
Pankaj Jagtap's user avatar
0 votes
1 answer
221 views

My coins were sent from my metamask wallet to another wallet without my consent

I just claimed tokens after a presale had ended from the token site to my metamask wallet. That transaction was successful. However, just one minute after that transaction took place, my coins were ...
john prasitsak's user avatar
0 votes
1 answer
42 views

Another contract is intercepting my contract calls and stealing the funds, what can it be?

This is the code I have, and I deployed to polygon mainnet to test. https://polygonscan.com/address/0x3CC3F39cc2386a8847378F4022917B3bB623BAFD // SPDX-License-Identifier: MIT // An example of a ...
Tsss's user avatar
  • 1
2 votes
1 answer
67 views

Can `msg.value` be trusted to remain the same after an external call?

Can msg.value be trusted to remain the same after the weth.deposit call in the foo function? pragma solidity >=0.8.19; interface WETHLike { function balanceOf(address account) external view ...
Paul Razvan Berg's user avatar
2 votes
1 answer
83 views

QuickAlerts Help!

I have been using QuickAlerts to track activities on my smart contract and receive a WebHook in my Discord server. How can I make sure that the WebHook is indeed coming from QuickAlerts and not a ...
Tien's user avatar
  • 193
0 votes
1 answer
47 views

Is it possible to do two-factor verification (email, text, let's say) using ethereum?

One of the values of a trusted, centralized authority is that it can use two-factor authentication to establish a permission to do a given action. Is it known whether an ethereum smart contract can ...
Larry Freeman's user avatar
0 votes
1 answer
104 views

Can't reproduce reentrancy if the smart contract has >= 19 ether in remix

I'm trying to understand reentrancy in solidity. I took the example from https://solidity-by-example.org/hacks/re-entrancy/.\ You can also take the original one if you want, the result is the same. ...
isaac's user avatar
  • 3
1 vote
1 answer
74 views

What does it mean by "rollups sends transactions on mainnet"?

While trying to understand what rollups are, I read rollups sends transactions to mainnet in a batch. I don't understand why and practically what does it do. To better understand it, I came up with a ...
Stav Alfi's user avatar
  • 206
0 votes
0 answers
19 views

How to improve the performance of a smart contract and secure it

I wrote a simple contract that exchanges the ERC 20 token for USDT, how can this code be improved in performance and what flaws or vulnerabilities it has // SPDX-License-Identifier: AGPL-3.0 pragma ...
Lll Cilician's user avatar
0 votes
1 answer
433 views

Detecting scam tokens on bsc pancakeswap

Certain contracts cannot be sold after buying on pancake swap apparently because they have code that makes that so. This is one example: 0x6d041ae2494641c229e9e348616f40bf390aa3f8 How is it that token ...
BAR's user avatar
  • 135
1 vote
2 answers
34 views

Ways to earn ETH passive income

I have a decent amount of ETH in my cold wallet (<32 ETH). These bag of ETH is my HODL bag, meaning that I don't want to spend it and I am planning to hold it for the next 10-20 years. What are my ...
Chunior's user avatar
  • 11
0 votes
1 answer
34 views

Identifying a Reentrancy Attack Vulnerability

Can this function be subject to a reentrancy attack? Are there simple code smells for identifying them? function collect() external { payable(owner()).call{value: address(this).balance}(&...
Emanegux's user avatar
  • 123
0 votes
0 answers
20 views

does empty function has security risks?

I have to implement the following interface in my contract interface IMetadataRenderer { function tokenURI(uint256) external view returns (string memory); function contractURI() external view ...
sciNFTist.eth's user avatar
0 votes
1 answer
246 views

When should I use ReentrancyGuard in a smart contract?

I am looking at the ReentrancyGuard smart contract from Open Zeppelin and I don't understand when I have to use it. Is it necessary in all my smart contracts or do I only have to add it in some ...
Falcon Stakepool's user avatar
0 votes
1 answer
189 views

Constructor arguments from EVM bytecode

I have a contract that results to the following bytecode: ...
oyinda david's user avatar
0 votes
0 answers
16 views

is EnQlave by QRL for post quantum Etheerum dependent on QRL Blockchain?

EnQlave is an initiative by QRL to secure Ethereum blockchain against quantum attacks. What QRL people claim is that the EnQlave wallet will not be dependent on any other blockchain other than ...
Anantashayana Hegde's user avatar
1 vote
1 answer
26 views

What is a good use case for .call functions' ability to pass a function call?

Following up on this thread, I wish to understand what will be a good use case using the feature to call a function in .call{}() ?
Mrigendra Soni's user avatar
1 vote
1 answer
61 views

storing and retrieving data in Solidity

in another solidity study, I want to implement a contract to store user links. users must log in using the wallet address and be able to save data by name, description, type, and the link itself. ...
Lll Cilician's user avatar
2 votes
1 answer
102 views

Security and Performance of Solidity Contract

I continue to explore solidity. I wrote a small distributor contract that collects ETH from incoming transactions, records the addresses of incoming transactions with a given condition, and ...
Lll Cilician's user avatar
2 votes
1 answer
152 views

Is my Smart Contract Secure and Optimized properly?

how safe is this code and is it possible to optimize it // SPDX-License-Identifier: AGPL pragma solidity ^0.8.17; interface IBEP20 { function transfer(address to, uint256 value) external returns ...
Lll Cilician's user avatar
1 vote
1 answer
314 views

Fake BUSD transcation sent from my wallet (not fake 0 token scam)!

Transaction Hash: 0x7800fb4d9345fc7e8b2794a479f414948eb1a9126e14daff11d1802440996a68 The hackers sent fake busd token (with >0 amount) from multiple victims wallet to another wallet without any ...
ken's user avatar
  • 11
0 votes
1 answer
69 views

Error: Expected string literal (path), "*" or alias list

I m currently working on smart contracts and i m trying test the contracts i wrote. I am using smartbugs tool. So far, i have executed the following commands in the powershell, git clone https://...
Porkodi Ishwarya's user avatar
0 votes
1 answer
49 views

Can i use oyente Tool on windows?

I am currently working with smart contracts. I want to perform security analysis on the smart contracts I developed. I tried using Oyente Tool and Docker in my Windows 10 Home system. But I can only ...
Porkodi Ishwarya's user avatar
2 votes
1 answer
72 views

How can ERC20 tokens be obtained in a local hardaht forked environment?

I've been learning about ethereum for a short time, besides my English could be better; if I'm wrong about something, please correct me. 😁 I am trying to test the interaction of different contract ...
4nibhal's user avatar
  • 21
0 votes
0 answers
7 views

What is smart contract re-entrance vulnerability?

What is re-entrance vulnerability? How can I prevent a smart contract from being re-entrant? What are some common vulnerabilities to watch out for?
PSS's user avatar
  • 529
1 vote
0 answers
109 views

How to pass web3 client from server to client in next.js?

I spent all day (meh, not a record (but I'm not finished yet lol)) trying to pass the web3 instance to the client side of my app. Why would I use it on the server side? Well, to keep my wallet ...
Eugene1111's user avatar
3 votes
0 answers
17 views

Ethereum sharding minimum committee size of 111 for safety

I am currently researching the minimum committee size required for Ethereum sharding. According to Vitalik, the minimum number of validators in a committee associated with a malicious committee ...
EagleEdge0423's user avatar
1 vote
1 answer
36 views

Can an encrypted message be safely revealed

In this demo Alice is using Bob's public key to sign a message that only the Bob can decrypt. Is it safe for Bob to reveal this decrypted message, or would that allow an attacker to determine his ...
Origin's user avatar
  • 133

1
2 3 4 5
17