Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
1
vote
0answers
11 views

Solidity PRNG with future block hashes: reasonable secure?

I would like someone to tell me if I am neglecting serious security concerns here. I Am trying to create a Solidity slot machine where hash puzzles (leading zeros) are used to get various jackpots. ...
1
vote
0answers
25 views

What would be the cost for one to mine one of his own block?

Smart contract built countermeasures against flash loan attacks. But some of them are just requiring the money to come from an eoa and thus are at risk from peoples who own the funds for themselves. ...
1
vote
1answer
44 views

How can I demonstrate attacks on Quorum-based smart contracts in my local test network?

Currently, I am conducting a research regarding the security and privacy vulnerabilities of Quorum-based smart contracts. However, so far I've been struggling to implement attack vectors in order to ...
1
vote
1answer
18 views

Best way to lock tokens for investors vesting period

What would be the most convenient way for our team to lock tokens for a vesting period for a relatively large number of wallets? (30+) We've considered team.finance as well as writing our own contract ...
1
vote
0answers
20 views

Can the Ethereum network work only with pruned nodes?

So if I got state trie pruning correctly, pruned nodes download all the block headers (so that they can check the PoW of the chain), the transactions of the last k (say 100) blocks (to resist against ...
0
votes
1answer
15 views

Secure data for NodeJs interface

I want to secure data for my NodeJs+Express+Mongodb website : ABI Contract address Infura.io API key Those data are very important because if an attacker can change them, it can steal ETH from my ...
0
votes
1answer
107 views

What wallet do support 25-word (24 words + extra word) seed phrases

I know only one wallet is supported 25 words seed phrase (24 words + extra word) is MEW. Are there else wallets that support 25 words seed phrases? UPDATE: I'm interested in wallets what can import/...
0
votes
2answers
61 views

Keystore File vs Mnemonic Phrase 24 words (25 words)

I read Ethereum HD wallet collision? and I'm really scared. The user generates an already used private key and gets access to money from another man. IMHO it is scary. Or do I misunderstand something? ...
0
votes
1answer
25 views

Create MEW HD Wallet

How I understand MEW suppose three cases of wallet: MEW Wallet By Keystore File By Mnemonic Phrase I know the created wallet by Mnemonic Phrase is kinda HD. What wallets are HD? And how can I ...
0
votes
0answers
22 views

How to secure metamask to avoid theft

I have a website with NODEJS and it's a Dapp. There is some button to click and open MetaMask for signing a transaction. I think an attacker car replace my ABI+Contract address and inject them with ...
1
vote
1answer
51 views

Change seed phrases

How I understand seed phrase is a secured phrase of my private keys. And then I have a question: If I create a wallet I get one seed phrase, one account and one private key. If I push another private ...
0
votes
0answers
21 views

How can someone withdraw the incoming money so quickly? 0x7E5F4552091A69125d5DfCb7b8C2659029395Bdf [duplicate]

How can someone withdraw the incoming money so quickly? 0x7E5F4552091A69125d5DfCb7b8C2659029395Bdf in - https://etherscan.io/tx/0xfbd225c6a5e7dc1ba76978d32914a6c18928a448540f2f235bca83e119c5f8a8 out - ...
0
votes
1answer
46 views

address payable[] public causing SWC 110 and execption state

This is the output of mythril ==== Exception State ==== SWC ID: 110 Severity: Medium Contract: XXXXXXX Function name: recipients(uint256) PC address: 2067 Estimated Gas Usage: 1089 - 1184 An assertion ...
5
votes
2answers
55 views

How do generalized sandwich attackers defend against Salmonella and Listeria?

Recently a trader extracted significant profits from sandwich attackers with a contract called Salmonella. The contract modifies the standard transfer function to send only a fraction of the requested ...
2
votes
1answer
30 views

Can you potentially mine for anything?

This is more of a general "blockchain" question and not specific to Ethereum so if I'm off topic here I would appreciate it if you could direct me to a more relevant stackexchange maybe. On ...
0
votes
0answers
13 views

in ETH ,how many full-nodes can light nodes select to access?

I want to ask how many full-nodes a light node can select to access if it wants to work safely.And if full-nodes are more than one ,Can the light node specify the node which the transaction is sent, ...
1
vote
1answer
156 views

Hacked Ethereum wallet — What do do with staked tokens?

My MetaMask wallet was unfortunately hacked and the hacker drained all of my tokens. I've sent some test tokens back to the wallet to check if the hacker had installed a smart contract to ...
0
votes
1answer
30 views

Create login on website using blockchain

Im looking to make a small website with some different actions in a "company". This is based on a blockchain and at the moment you can enter an address and then do the action. I would like ...
1
vote
1answer
318 views

How did this address steal my Ethereum ERC-20 Tokens using Uniswap? 0x2b5b060d57b1333c9b2739e9c15b039726dd51ec

I was using my Trust wallet on my mobile and tried to do a swap from ETH to an ERC20 token but realized a day after that it got drained to this account: https://etherscan.io/address/...
3
votes
1answer
157 views

How Tornado Cash Relayer trustless protocol works?

As anyone can see by the official GitHub repo, to became a Tornado Cash relayer, you need to install a node waiting for ZK Notes of the users. The node will provide them money they want to reclaim, ...
4
votes
0answers
65 views

What are best practices for monitoring the OpenEthereum (Parity) logging?

Monitoring of the logging output of the Ethereum clients is essential for stable blockchain operation. Do you have recommendations, experiences and/or lessons learned concerning the logging of ...
1
vote
1answer
128 views

How do I determine the most recommended (safest to use) version of Solidity?

I've seen this question pop-up a bunch of times: "is version 0.x.x safe to use in production?" Therefore, I'm wondering if there is a clear way to tell which versions are recommended for ...
0
votes
1answer
42 views

Are seed phrases universal?

I was recently using metamask, an ether wallet, when i noticed something weird. Upon installation, I attempted to import an external wallet using a seed phrase. I was told, according to the app, it ...
0
votes
1answer
14 views

How to restrict function to only callable from one external contract?

I have a Reputation contract which has a function foo() that sets some point. In another contract called Market I want to use the foo() function. But I don't want any one to be able to call foo() ...
0
votes
1answer
28 views

Why this delegatecall attack not working?

I am confused by this simple contract. The main purpose is to bypass the OnlyContract() modifier. Victim contract. pragma solidity 0.7.6; contract Victim { modifier OnlyContract() { ...
0
votes
1answer
769 views

hacked from metamask wallet

yesterday 2.3.2021 at 18:25 i was hacked. they stole all my founds from metamusk wallet from my address 0xeD14989682D3770AC0a9AEB2608Aa2315cF312Df and took everything to this address ...
3
votes
3answers
111 views

What if a chain is compromised?

I have deployed a dApp on a sidechain (namely xDai) and am worried about its security. What happens if an EVM chain is compromised? Will it be rolled back after a few hours? or what? If the mainnet is ...
0
votes
1answer
27 views

Authentication between smart contracts based their addresses - Is it safe?

thanks in advance for your time and intellectual contribution. I am working on a project in which we have contracts interacting which each other. More specifically, there is a "father contract&...
3
votes
0answers
109 views

Safe implementation on Solidity 0.8.0 of a withdrawal and a refund

I'm here for asking of a SECURE way to implement on solidity 0.8.0 two functions: 1-Withdrawal() which sends all the ether of the smart contract to the owner address. My current implementation is: //...
1
vote
1answer
69 views

Security implementation of a function in Solidity

I'm here for asking some tips on calling function from other contracts in solidity. Here is the function for generating a random number (which I need in the main contract) using the chainlink VRF. ...
0
votes
1answer
24 views

What is the legitimate use case of using library contract without using contract address?

Let us look at the following contract contract LibraryA { function getSenderAddress() public returns (address); } contract LibraryB { function getSenderAddress() public returns (address);...
2
votes
0answers
62 views

Even if I own 51% of stake (or have 51% computational power) and try to cheat, can't others still see that my block is invalid?

I'm thinking about how proof of stake works exactly. As I understand, here is how it is secure: I cannot forge a tx where random A pays me X amount because I would need the private keys of A. ...
1
vote
0answers
38 views

eip-1967 address calculation

I have read EIP-1967 and i have study how work proxy contracts. There is something i do not understand in EIP-1967. Here is what i have understood: Logic contract's storage variables are stored in ...
0
votes
0answers
26 views

What is the best practice when storing a custodial wallet with node.js and mysql?

I'm using Adonis.js v4 (it's node.js) and mysql (on RDS) as my database. I need to create an ethereum wallet for each of my user's and I need to make transaction on their behalf with their wallet (...
0
votes
0answers
49 views

one wallet address, multiple users, what is the best way to keep the private key secured?

I would like to develop an application using the web3j. However, it needs to be just one wallet that multiple users will deposit and withdraw from. The allowances are kept in a centralized database. ...
1
vote
3answers
49 views

Do view functions cause reentrancy vulnerabulity?

It's well known that calling an external function before changing something in the contract causes a security problem called "reentrancy vulnerability". Does calling an external function ...
0
votes
0answers
22 views

Is it possible for an attacker to exploit contracts that rely on incoming “msg.value”?

I am developing an eth2.0 fuzzer for my masters that has produced some interesting crashes - if these crashes are legitimate I believe I may have found a new vulnerability - otherwise, I still have a ...
0
votes
1answer
18 views

If contracts can be proxied to other contracts, how can a user trust them?

Based on the upgradeable smart contract pattern, a smart contract author can create a contract x that proxies to contract y. Let's say the contract is an ERC20 token where Alice buys 100 tokens. How ...
0
votes
1answer
17 views

Why is sending ETH from multiple accounts in a single transaction deemed a “security hole”?

A user on Ethereum SE posted the following As you noticed, there is no way to send a single from multiple addresses. There is always just one sender. For Ether transfers the Ether value is always ...
5
votes
1answer
336 views

Explain “griefing” attack on Aave flash loan

Aave doc about flash loan warns to never store funds inside a receiver contract as it can be exposed to "griefing" attack. So my questions are Can you give an example of this attack? How ...
1
vote
1answer
545 views

How are Metamask web wallets traceable to owner identity?

When creating a Metamask wallet as a Chrome browser extension, what are all the different identifiers that match the wallet to its owner? Since it takes a password to log into the Metamask wallet, ...
0
votes
2answers
61 views

Can Ethereum wallets be deleted for fraud?

Stellar Foundation, who created the Stellar Lumens coin (XLM), are able to shut down XLM addresses that engage in fraud. Stellar scammers often send small payments to other XLM wallets at random with ...
0
votes
0answers
14 views

Why is serprent considered untrusted?

Serpent was way to fetch Diesel prices from the oraclize api at fixed intervals. On GitHub, it s written audits proved the code to be flawed, but where are such audits? I m meaning why is it flawed?
0
votes
0answers
17 views

About security problem on hard fork named “Spurious Dragon”

What is the specific problem with the secuirty of "Spurious Dragon" (EIP-170)? I've heard that EXTCODESIZE isn't checked when accessing the constructor and doesn't cost a gas fee, but I'm ...
0
votes
0answers
14 views

private network impersonation attack

I've set up a 5-node network with 3 validator nodes. I would like to test the integrity of the blockchain by having a non-validator node attempt to validate a new transaction. How can I go about doing ...
1
vote
1answer
74 views

The security of JSON-RPC

I currently use web3 and geth to develop dapps, and we know that web3 interacts with geth through json rpc. If we want to unlock an account through dapp, we need to enter the password in the dapp, and ...
1
vote
1answer
19 views

How to properly invalidate the manager?

In MyContract, I am providing special rights to the manager. But after some time and for some reason, I want to invalidate the manager. The following is my approach: // SPDX-License-Identifier: GPL-3....
0
votes
1answer
44 views

Deploy basic proxy with arguments

https://github.com/optionality/clone-factory/blob/master/contracts/CloneFactory.sol#L32 contains a code to deploy a basic proxy. This code misses a way to pass data to the proxied contract to init it. ...
1
vote
1answer
122 views

The security problem of tx.origin in Solidity

The book Mastering Ethereum pointed out that it is not safe to use tx.origin in smart contracts. I want to know what is the reason for insecurity?
0
votes
0answers
14 views

Is it possible for miner to tamper with the results when executing smart contracts?

When Miner A executes the smart contract, a result is generated and broadcast to the entire network. I want to know if this result may have been tampered with. If this is possible, how do other miners ...

1
2 3 4 5
13