Questions tagged [security]
Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.
838
questions
0
votes
1
answer
18
views
Are multiplications after division UNSAFE?
I have a smart contract which essentially does this:
uint256 tokenRate = _pair.a2 * PRECISION_FACTOR / _pair.a1;
uint256 toSend = _amount * tokenRate / PRECISION_FACTOR;
uint256 feeToOwner2 = toSend ...
- 640
1
vote
1
answer
18
views
How prevent of attack in Ethereum
I hope you are well. The topic of my thesis is to increase security in blockchain-based IoMT (Internet of Medical Things). I aim to present new ideas to reduce attacks in the blockchain, considering ...
- 11
2
votes
1
answer
36
views
Is there a way to stop wallet homomorph attacks without ditching the create2 opcode?
Losses from create2 wallets that look similar to recently active wallets has surpassed $60m:
https://gbhackers.com/create2-bypass-wallet-security-alerts/
Even today I made a transaction, and noticed ...
- 141
0
votes
0
answers
6
views
Would this work to add a check that a signature hasn't already been used?
I'm working on an exercise to learn smart contract security, and I am trying to add a check that a signature has not been previously used to this withdraw function. Below I put the original function ...
- 41
2
votes
1
answer
14
views
Is it profitable for a miner to manipulate blocks in a small Ethereum project?
In the context of my blockchain project, I’m using the blockhash() function to generate randomness. However, I’m concerned about the potential vulnerability of this method. I’d like to know if, in a ...
- 21
0
votes
0
answers
4
views
Data Based and System Security
Over the last year or so, ever since I started messing around with the blockchain protocol, I my system, database, seems to have gotten hacked time and time again.
I have learned a great deal with ...
0
votes
1
answer
43
views
How to download and install Echidna?
I have just started learning echidna but i havent found any detailed information of how to install and setup echidna in WSL.
- 41
0
votes
1
answer
59
views
What is "pig butchering" scam?
What is the "pig butchering" scam? Why is it called "pig butchering"? What are some of its elements? How bad can it get?
eth♦
- 85.1k
0
votes
1
answer
42
views
To what extent was the block hash malleable under proof-of-work?
To emphasise, I’m solely interested in blocks prior to the transition to PoS.
Given that a miner making any change to the block header would have resulted in a completely different hash, my thinking ...
- 135
1
vote
2
answers
131
views
Can your Metamask get hacked by signing a message, no gas?
If I log into a new project with Metamask, and the operation costs no gas, can I get hacked?
Does no gas mean you are safe when signing with Metamask?
- 133
1
vote
0
answers
38
views
Creating a sufficiently random number via computation entropy without an oracle
I am creating a token that requires a sufficiently random number for an internal lottery.
uint randomX;
function semirandomize(uint prevRandom, uint time) private view returns (uint) {
...
- 79
0
votes
2
answers
92
views
ERC20 token smart contract check
I updated my smart contract code according to the explanations you gave and the instructions you gave. Please, if possible, check the rewritten code again and give your general opinion, is this smart ...
- 63
0
votes
1
answer
22
views
Use offchain date time
in my contract, I need to do something based on time, and this is quite sensitive, and as we know, you cannot rely on the block.timestamp because it can be changed, I want to know if there is a way ...
- 481
1
vote
1
answer
30
views
Is it secure to use multiple admin
im trying to do multiple admin system in my solidity and here is example
//SPDX-License-Identif`ier: MIT
pragma solidity 0.8.15;
import "@openzeppelin/contracts/access/Ownable.sol";
...
- 13
1
vote
1
answer
36
views
Building Cryptocurrency Tracking system for monitoring stolen cryptocurrency transactions
When hackers steal tokens from an account, what they generally do is divert the flow of tokens via multiple proxy accounts making it complicated for the cyber-forensics department to track final ...
1
vote
0
answers
33
views
How to run a script which requires a private key completely in a browser?
For a non-technical person I need to create a page on my website, in the admin area, in which he'd regularly do stuff that normally is done on local machine only. That is, a person doesn't want to go ...
- 49
0
votes
0
answers
28
views
Connect & interact with dApp without wallet connection
I have a question regarding the issues I am facing on my current project. I am building NFT marketplace on the Polygon network.
The specific requirement is we should allow the users can interact with ...
- 13
0
votes
2
answers
42
views
What are the best up-to-date secure approaches of generating pseudorandom number in Solidity? [duplicate]
I am thinking about creating a lottery with more than one winner and one round for users. Please don't consider usual 'commit-reveal' scheme. However, person can claim rewards on their own at the end ...
- 13
0
votes
1
answer
30
views
What is an re-entrancy attack and how does it work?
With the recent exploit on the omnipools on Conic Finance. The hacker used an exploit called: re-entrancy attack. How does it work explained in layman terms?
And what should smart contract auditors ...
- 4,800
12
votes
1
answer
2k
views
I got scammed or suspect scam on Ethereum. What to do?
This is a general question and answer on ethereum.stackexchange.com to all "I got scammed, please help" posts.
This applies to you if you think:
You have been scammed
You think something ...
- 21.8k
1
vote
1
answer
105
views
What are the possible security threats when using mappings in Solidity?
Does the use of a nested mapping possess any threats to the security of the contract below?
contract Users {
struct User {
address payable regAddress;
uint64 timestamp;
...
- 264
1
vote
0
answers
46
views
How to prevent replay attacks on ZK Proof Transactions?
Alice wants to prove a statement (let's say, she has a secret value x such that x * 2 = 10) to Bob without revealing x).
Alice generates a proof using the ZK-Snark protocol.
const { proof, ...
- 296
1
vote
2
answers
210
views
Which of <= and < comparison operators use less gas in Solidity?
if(num <= 10) revert();
And
if(num < 11) revert();
Which of these statements consume less gas?
If we could save gas, we need not use less than/greater than equal to. We can just use less than ...
0
votes
1
answer
221
views
My coins were sent from my metamask wallet to another wallet without my consent
I just claimed tokens after a presale had ended from the token site to my metamask wallet. That transaction was successful. However, just one minute after that transaction took place, my coins were ...
0
votes
1
answer
42
views
Another contract is intercepting my contract calls and stealing the funds, what can it be?
This is the code I have, and I deployed to polygon mainnet to test. https://polygonscan.com/address/0x3CC3F39cc2386a8847378F4022917B3bB623BAFD
// SPDX-License-Identifier: MIT
// An example of a ...
- 1
2
votes
1
answer
67
views
Can `msg.value` be trusted to remain the same after an external call?
Can msg.value be trusted to remain the same after the weth.deposit call in the foo function?
pragma solidity >=0.8.19;
interface WETHLike {
function balanceOf(address account) external view ...
- 17.3k
2
votes
1
answer
83
views
QuickAlerts Help!
I have been using QuickAlerts to track activities on my smart contract and receive a WebHook in my Discord server. How can I make sure that the WebHook is indeed coming from QuickAlerts and not a ...
- 193
0
votes
1
answer
47
views
Is it possible to do two-factor verification (email, text, let's say) using ethereum?
One of the values of a trusted, centralized authority is that it can use two-factor authentication to establish a permission to do a given action.
Is it known whether an ethereum smart contract can ...
- 103
0
votes
1
answer
104
views
Can't reproduce reentrancy if the smart contract has >= 19 ether in remix
I'm trying to understand reentrancy in solidity.
I took the example from https://solidity-by-example.org/hacks/re-entrancy/.\
You can also take the original one if you want, the result is the same.
...
- 3
1
vote
1
answer
74
views
What does it mean by "rollups sends transactions on mainnet"?
While trying to understand what rollups are, I read rollups sends transactions to mainnet in a batch. I don't understand why and practically what does it do.
To better understand it, I came up with a ...
- 206
0
votes
0
answers
19
views
How to improve the performance of a smart contract and secure it
I wrote a simple contract that exchanges the ERC 20 token for USDT, how can this code be improved in performance and what flaws or vulnerabilities it has
// SPDX-License-Identifier: AGPL-3.0
pragma ...
- 127
0
votes
1
answer
433
views
Detecting scam tokens on bsc pancakeswap
Certain contracts cannot be sold after buying on pancake swap apparently because they have code that makes that so.
This is one example:
0x6d041ae2494641c229e9e348616f40bf390aa3f8
How is it that token ...
- 135
1
vote
2
answers
34
views
Ways to earn ETH passive income
I have a decent amount of ETH in my cold wallet (<32 ETH). These bag of ETH is my HODL bag, meaning that I don't want to spend it and I am planning to hold it for the next 10-20 years.
What are my ...
- 11
0
votes
1
answer
34
views
Identifying a Reentrancy Attack Vulnerability
Can this function be subject to a reentrancy attack? Are there simple code smells for identifying them?
function collect() external {
payable(owner()).call{value: address(this).balance}(&...
- 123
0
votes
0
answers
20
views
does empty function has security risks?
I have to implement the following interface in my contract
interface IMetadataRenderer {
function tokenURI(uint256) external view returns (string memory);
function contractURI() external view ...
0
votes
1
answer
246
views
When should I use ReentrancyGuard in a smart contract?
I am looking at the ReentrancyGuard smart contract from Open Zeppelin and I don't understand when I have to use it.
Is it necessary in all my smart contracts or do I only have to add it in some ...
- 685
0
votes
1
answer
189
views
Constructor arguments from EVM bytecode
I have a contract that results to the following bytecode: ...
0
votes
0
answers
16
views
is EnQlave by QRL for post quantum Etheerum dependent on QRL Blockchain?
EnQlave is an initiative by QRL to secure Ethereum blockchain against quantum attacks. What QRL people claim is that the EnQlave wallet will not be dependent on any other blockchain other than ...
1
vote
1
answer
26
views
What is a good use case for .call functions' ability to pass a function call?
Following up on this thread, I wish to understand what will be a good use case using the feature to call a function in .call{}() ?
1
vote
1
answer
61
views
storing and retrieving data in Solidity
in another solidity study, I want to implement a contract to store user links. users must log in using the wallet address and be able to save data by name, description, type, and the link itself. ...
- 127
2
votes
1
answer
102
views
Security and Performance of Solidity Contract
I continue to explore solidity. I wrote a small distributor contract that collects ETH from incoming transactions, records the addresses of incoming transactions with a given condition, and ...
- 127
2
votes
1
answer
152
views
Is my Smart Contract Secure and Optimized properly?
how safe is this code and is it possible to optimize it
// SPDX-License-Identifier: AGPL
pragma solidity ^0.8.17;
interface IBEP20 {
function transfer(address to, uint256 value) external returns ...
- 127
1
vote
1
answer
314
views
Fake BUSD transcation sent from my wallet (not fake 0 token scam)!
Transaction Hash: 0x7800fb4d9345fc7e8b2794a479f414948eb1a9126e14daff11d1802440996a68
The hackers sent fake busd token (with >0 amount) from multiple victims wallet to another wallet without any ...
- 11
0
votes
1
answer
69
views
Error: Expected string literal (path), "*" or alias list
I m currently working on smart contracts and i m trying test the contracts i wrote. I am using smartbugs tool. So far, i have executed the following commands in the powershell,
git clone https://...
0
votes
1
answer
49
views
Can i use oyente Tool on windows?
I am currently working with smart contracts. I want to perform security analysis on the smart contracts I developed. I tried using Oyente Tool and Docker in my Windows 10 Home system. But I can only ...
2
votes
1
answer
72
views
How can ERC20 tokens be obtained in a local hardaht forked environment?
I've been learning about ethereum for a short time, besides my English could be better; if I'm wrong about something, please correct me. 😁 I am trying to test the interaction of different contract ...
- 21
0
votes
0
answers
7
views
What is smart contract re-entrance vulnerability?
What is re-entrance vulnerability? How can I prevent a smart contract from being re-entrant? What are some common vulnerabilities to watch out for?
- 529
1
vote
0
answers
109
views
How to pass web3 client from server to client in next.js?
I spent all day (meh, not a record (but I'm not finished yet lol)) trying to pass the web3 instance to the client side of my app. Why would I use it on the server side? Well, to keep my wallet ...
- 59
3
votes
0
answers
17
views
Ethereum sharding minimum committee size of 111 for safety
I am currently researching the minimum committee size required for Ethereum sharding. According to Vitalik, the minimum number of validators in a committee associated with a malicious committee ...
1
vote
1
answer
36
views
Can an encrypted message be safely revealed
In this demo Alice is using Bob's public key to sign a message that only the Bob can decrypt. Is it safe for Bob to reveal this decrypted message, or would that allow an attacker to determine his ...
- 133