Skip to main content

Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
2 votes
1 answer
68 views

EIP-3448 really need the metadata length or is it optional?

If you check the specs of EIP-3448, it states: "The last 32 bytes (one word) of the bytecode must indicate the length of the metadata in bytes." However, if this is not included in the ...
Iftikhar uddin's user avatar
0 votes
0 answers
10 views

What is the _statsTracker address on some ERC-20 contracts?

I've been finding some ERC-20 contracts having a _statsTracker address, which then gets used like so: if (_statsTracker != address(0)) { IStatsTracker(_statsTracker).updateTransferStats(address(...
Abraham P's user avatar
  • 103
0 votes
0 answers
9 views

Why is only the first call frame aliased on Optimism?

Because addresses can be impersonated cross-chain, rollups have to alias addresses when L1 to L2 transactions are performed. From Optimism's docs: CALLER msg.sender If the transaction is an L1 ⇒ L2 ...
Paul Razvan Berg's user avatar
0 votes
2 answers
29 views

where does popular bridges keeps their private key in backend in dapps?

I have an interesting question, that major players of bridges and other dapps, where do they store their private keys at their backend? I mean what flow do they decide so that only owner of that ...
Manav Notnani's user avatar
0 votes
0 answers
15 views

Most decentralized and secure ways of listening to events for multiple wallets

The most common for listening to events emitted by multiple smart contracts seems to be by using a JSON-RPC wrapper such as ethers or web3js. Let the contracts be ERC-721. If our contract emits an ...
root's user avatar
  • 11
0 votes
0 answers
24 views

The token was hacked in my smart contract

The transactions below were not created by me. Someone else withdrew tokens from my smart contract. The hack occurred in a transaction that creates a smart contract. How is this possible? https://...
유동근's user avatar
2 votes
1 answer
60 views

Can a user impersonate a smart contract address - and use it as an EOA?

First of all: I'm aware of the fact that only EOAs sign/create txs in Ethereum, that the public address of an EOA and the address of a Smart Contract are calculated differently and that it's ...
Iaroslav's user avatar
  • 365
0 votes
1 answer
15 views

Does Ethereum ever charge an "unusual funds fee" [duplicate]

Trust wallet is telling me I am being charged an unusual funds fee by Ethereum for a mysterious deposit which appeared in my account. I didn't make the deposit.
Sean's user avatar
  • 11
1 vote
2 answers
82 views

Why is my account frozen? [duplicate]

My accounts in Ether universe are frozen. I'm trying to find out why. Trust wallet is asking me to pay a third party unusual funds fee.
Sean's user avatar
  • 11
1 vote
1 answer
65 views

What number of confirmations is considered secure in Polygon?

In Bitcoin, 4 confirmations are considered secure (very low probability of transaction/block reversal). What is the current number in Polygon?
Falcon Stakepool's user avatar
0 votes
0 answers
29 views

Geth Private Network - Account management

I'm building a private blockchain using Geth. I created 2 accounts with command geth --datadir miner-node account new and geth --datadir rpc-node account new, then I added their address to genesis....
revSurfer's user avatar
0 votes
0 answers
21 views

Is everything okay with this Presale contract?

Could you help me check if this presale contract does what it's supposed to do and if it's safe? I tried to find bugs or flaws but couldn't find anything. The theory is very simple: the user can use ...
Integral's user avatar
  • 115
0 votes
2 answers
67 views

Is it possible to manipulate V2 getAmountOut() or V3 sqrtPriceX96 using Uniswap flash swaps or any kind of flash loan

I use this calls: IUniswapV2Router(uniswapV2Router).getAmountOut(tokenAmount, reserve1, reserve0) // Uniswap V2 token price (uint160 sqrtPriceX96, , , , , , ) = uniswapV3Pool.slot0(); // Uniswap V3 ...
blockson's user avatar
0 votes
0 answers
42 views

Token Transfer in the absence of _isApprovedOrOwner

I have created a smart contract in which I have a method called forSale used to store a flag (in a struct part of a mapping) indicating that the owner of an ERC721 token wishes to sell his said token (...
JF0001's user avatar
  • 291
0 votes
0 answers
90 views

Adding liquidity for honeypot scam tokens

I have bought into my share of honeypot scam tokens over the years. I am not sore about it - I accept it as an 'operating cost' of trading in risky tokens. But I was curious whether I could take these ...
obenihk's user avatar
0 votes
0 answers
21 views

Geth private network security

I'm implementing a private network with Geth, which is expected to go into production for a client. What are the most important points to focus on regarding the security of my blockchain? I was ...
revSurfer's user avatar
0 votes
0 answers
7 views

How to record proof of contract exploit on-chain?

Suppose one want to insure from certain contract hacks. Do do that in non custodial manner, we need some way to detect hack on-chain. I see some obvious ideas, like "if one wallet stores more ...
uhbif19's user avatar
  • 101
0 votes
0 answers
21 views

Eth_sign, blind singing and MM signing

Having some confusion on what is what here. Is there difference in enabling eth_sign in metamask with blind signing on ledger? Many web3 sites today require user to sign message as log in method. I ...
Blissful's user avatar
  • 382
1 vote
1 answer
52 views

Reentrancy Guard and CEI

Could you please explain, is there a need to use a ReentrancyGuard modifier if the contract follows the CEI(Check Effect Interactions) pattern? If yes, could you bring an example, where the contract ...
Mark's user avatar
  • 13
0 votes
1 answer
137 views

Permit and transferFrom function called on an ERC20 which drained a specific token in my wallet

I recently found out I've been drained of around 1600 $ALT tokens in two separate transactions a few days ago. It sucks to lose money, but it sucks even more if you never know how it happened and what ...
Meysam's user avatar
  • 3
3 votes
1 answer
303 views

Where does Metamask store the private key (when the account is only locked with a machine-specific password)?

Where does Metamask store the private keys of an EVM-account after one recovers an account with private keys? Does it cipher the private keys before writing to storage, e.g. encoding with the access ...
Mila A's user avatar
  • 1,299
0 votes
0 answers
10 views

How to use ethereum on decentralized exchanges in the US?

See https://www.reddit.com/r/Bitcoin/comments/145yka4/comment/jnoduy1/?utm_source=share&utm_medium=web2x&context=3 Dex's don't deal with Fiat directly, you always need a cex to buy your ...
Ralph Yozzo's user avatar
0 votes
0 answers
5 views

Implement a secure communication mechanism between the smart contract and the client."

I'm developing a dapp to allow users to chat with each other. The problem is that I need to ensure the security of the transmitted messages. What mechanism can be used to make the communication ...
grn.1002's user avatar
0 votes
1 answer
25 views

I get blackmailed by a person from which I have only the Etherium wallet adress [duplicate]

I need help to identify a person that is blackmailing with what she thinks is compromising material, to send it to family, colleagues, etc etc, if I do not pay 300 € (as a start) to settle the issue. ...
Matthias's user avatar
1 vote
0 answers
386 views

What are examples of high-liquidity ERC777 tokens on ETHEREUM? Any other token standards apply too, as long as there's a beforeTransfer callback

I'm looking to make a list of popular tokens that implement hooks on transferFrom(address owner, address receiver, uint256 amount) and are deployed on the Ethereum blockchain in particular. For ...
Mila A's user avatar
  • 1,299
0 votes
1 answer
201 views

New Metamask account randomly sending funds to another wallet

I made a new secondary account under my wallet and immediately transferred funds to it through Coinbase exchange. In less than 4 mins, the new account made a random unauthorized transfer to a random ...
heng heng's user avatar
0 votes
1 answer
21 views

Ethernaut Alien Codex Gas Estimation Failed

When i call attack() or exploit() function the remix shows Gas Estimation Failed. The code is copied from existing solution available on internet. so code is correct, can someone please help me why I ...
Shubham's user avatar
  • 25
1 vote
1 answer
386 views

backend based signature verification

I'm new in web3 and I'm trying to develop a way to authenticate users in my dapp. I'm used to using the old and safe method with email + password to do that, but recently I realised that I could use ...
whoami's user avatar
  • 13
0 votes
0 answers
16 views

Learning to test

I am currently learning how to test SC with foundry and I feel with each different contract that I test that I really don't learn anything, any study recommendations?
David Antunez's user avatar
1 vote
1 answer
53 views

Understanding Reentrancy attacks

I'm trying to understand the mechanism for a reentrancy attack, and how it might be mitigated. I'm looking at (for example) this scan result: https://de.fi/scanner/contract/...
Abraham P's user avatar
  • 103
1 vote
2 answers
38 views

Audit Vulnerability Findings

As a person who is interested in smart contract auditing but have never done before I have this question in my head. What if an auditor finds a lets say critical vulnerability which will enable him to ...
qursk's user avatar
  • 13
4 votes
0 answers
125 views

BLS signatures and the Splitting Zero attack

In 2021 security researcher Quan Thoi Minh Nguyen published two papers ("0" and "Attacks and weaknesses of BLS aggregate signatures") where he highlighted some security weaknesses ...
BrainGrind's user avatar
0 votes
0 answers
20 views

Purposely failing Low-Level Call

Does this code below have a vulnerability? burnAddress.call.value(msg.value)(""); //update state burn Address is a trusted contract, which ...
Pramoxlol's user avatar
0 votes
1 answer
133 views

Are multiplications after division UNSAFE?

I have a smart contract which essentially does this: uint256 tokenRate = _pair.a2 * PRECISION_FACTOR / _pair.a1; uint256 toSend = _amount * tokenRate / PRECISION_FACTOR; uint256 feeToOwner2 = toSend ...
Iulian's user avatar
  • 640
1 vote
1 answer
26 views

How prevent of attack in Ethereum

I hope you are well. The topic of my thesis is to increase security in blockchain-based IoMT (Internet of Medical Things). I aim to present new ideas to reduce attacks in the blockchain, considering ...
Samaneh's user avatar
  • 11
2 votes
1 answer
49 views

Is there a way to stop wallet homomorph attacks without ditching the create2 opcode?

Losses from create2 wallets that look similar to recently active wallets has surpassed $60m: https://gbhackers.com/create2-bypass-wallet-security-alerts/ Even today I made a transaction, and noticed ...
rook's user avatar
  • 141
0 votes
0 answers
11 views

Would this work to add a check that a signature hasn't already been used?

I'm working on an exercise to learn smart contract security, and I am trying to add a check that a signature has not been previously used to this withdraw function. Below I put the original function ...
user127148's user avatar
2 votes
1 answer
16 views

Is it profitable for a miner to manipulate blocks in a small Ethereum project?

In the context of my blockchain project, I’m using the blockhash() function to generate randomness. However, I’m concerned about the potential vulnerability of this method. I’d like to know if, in a ...
Vlad's user avatar
  • 21
0 votes
0 answers
5 views

Data Based and System Security

Over the last year or so, ever since I started messing around with the blockchain protocol, I my system, database, seems to have gotten hacked time and time again. I have learned a great deal with ...
Scott-Group's user avatar
0 votes
1 answer
328 views

How to download and install Echidna?

I have just started learning echidna but i havent found any detailed information of how to install and setup echidna in WSL.
kumar's user avatar
  • 61
1 vote
1 answer
187 views

What is "pig butchering" scam?

What is the "pig butchering" scam? Why is it called "pig butchering"? What are some of its elements? How bad can it get?
eth's user avatar
  • 86.2k
0 votes
1 answer
44 views

To what extent was the block hash malleable under proof-of-work?

To emphasise, I’m solely interested in blocks prior to the transition to PoS. Given that a miner making any change to the block header would have resulted in a completely different hash, my thinking ...
user72364's user avatar
  • 135
1 vote
2 answers
1k views

Can your Metamask get hacked by signing a message, no gas?

If I log into a new project with Metamask, and the operation costs no gas, can I get hacked? Does no gas mean you are safe when signing with Metamask?
kintsukuroi's user avatar
1 vote
0 answers
58 views

Creating a sufficiently random number via computation entropy without an oracle

I am creating a token that requires a sufficiently random number for an internal lottery. uint randomX; function semirandomize(uint prevRandom, uint time) private view returns (uint) { ...
Ashraile's user avatar
  • 125
0 votes
2 answers
238 views

ERC20 token smart contract check

I updated my smart contract code according to the explanations you gave and the instructions you gave. Please, if possible, check the rewritten code again and give your general opinion, is this smart ...
Ali's user avatar
  • 63
0 votes
1 answer
28 views

Use offchain date time

in my contract, I need to do something based on time, and this is quite sensitive, and as we know, you cannot rely on the block.timestamp because it can be changed, I want to know if there is a way ...
Mehran Ra's user avatar
  • 590
1 vote
1 answer
64 views

Is it secure to use multiple admin

im trying to do multiple admin system in my solidity and here is example //SPDX-License-Identif`ier: MIT pragma solidity 0.8.15; import "@openzeppelin/contracts/access/Ownable.sol"; ...
Mert Tanıtan's user avatar
1 vote
1 answer
53 views

Building Cryptocurrency Tracking system for monitoring stolen cryptocurrency transactions

When hackers steal tokens from an account, what they generally do is divert the flow of tokens via multiple proxy accounts making it complicated for the cyber-forensics department to track final ...
Rohit Jambhulkar's user avatar
1 vote
0 answers
62 views

How to run a script which requires a private key completely in a browser?

For a non-technical person I need to create a page on my website, in the admin area, in which he'd regularly do stuff that normally is done on local machine only. That is, a person doesn't want to go ...
Nondi's user avatar
  • 49
0 votes
0 answers
76 views

Connect & interact with dApp without wallet connection

I have a question regarding the issues I am facing on my current project. I am building NFT marketplace on the Polygon network. The specific requirement is we should allow the users can interact with ...
legendary's user avatar

1
2 3 4 5
18