Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
0
votes
0answers
19 views

Smart Contracts for Cyber? [closed]

While the applicability of smart contracts is well documented in finance, trade, and insurance, I'm trying to wrap my head around potential use case for smart contracts in cybersecurity domains. Does ...
1
vote
1answer
47 views

In the case the Zerofunctionselector bug, how to know which function NAME as a 0 selector?

Normally, If a smart contract is not affected by the Zerofunctionselector bug, then at the end of the code which makes jump to the target function lies a 0xfe opcode (which result in the smart ...
0
votes
2answers
439 views

Division/Percentages in Solidity (a workaround)

Division/percentages is a required part of many applications but is difficult to implement since fixed and ufixed are not supported yet in Solidity. I've come up with this workaround: pragma ...
1
vote
1answer
27 views

adaptive vs. non-adaptive adversaries? Is there a precise, unique and general definition? (Updated)

In this Ethereum github page (Link to the page: https://github.com/ethereum/wiki/wiki/Sharding-FAQ#what-are-the-security-models-that-we-are-operating-under) there is a very brief definition of the ...
0
votes
1answer
53 views

What bad things could happens if Geth RPC is public?

Geth does not ship with RPC support. By default Geth enables modules ["net", "web3", "eth", "shh"]. In case the RPC get compromised, what kind of bad things could happens? Money lost will definitely ...
3
votes
2answers
207 views

Confidential value transfers

Is there currently any way to do confidential transactions with Ethereum for a custom token? If not, is there any work/research being done on how this might be possible?
0
votes
1answer
62 views

Automatically test who can withdraw Ether from a smart contract

Is there any way I can automatically test who can withdraw ether from a smart contract? I need to perform this test automatically. So I cannot manually inspect the instructions. Can I design a smart ...
0
votes
1answer
42 views

Proxy function clashing - what kind of danger comes exactly with it?

I read that if I am using proxy, there is a chance of function clashing. Let's say in my contract there is a function with a signature: proxyOwner() ...
0
votes
1answer
26 views

When a Callcalled contract calls an other contract normally, who is msg.sender?

If I understand correctly CALLCODE substitute/replace (and not add) the ledger of the target contract with the one the calling contract, isn’t it ? So that when contract Victor CALLCODE Alice, Alice ...
2
votes
1answer
77 views

Prevent other mining softwares to mine my public forked Ethereum chain

I forked an Ethereum chain and put it as public, but I only want my own software/client to be able to mine. Other miners using ethminer, geth, etc, cannot mine and profit from my chain (At least not ...
0
votes
1answer
93 views

Security Implications of allowing remote RPC connections to Geth Node

What are the security Implications of allowing remote RPC connections to Geth Node? If one absolutely needs to allow remote rpc connections for web3 connection, how can one do this while securing the ...
0
votes
1answer
41 views

User anonymity while submitting data in smart contract

I've written a smart contract, that is a crowd sensing system. Where post posting a task user view that task and if they have what I'm asking for/and meet the task requirements they submit certain ...
0
votes
1answer
89 views

Quorum Consensus - BAR (Byzantine Altruistic Rational) Fault Tolerance / BAR Fault Tolerance / BAR Model

I refer to http://www.cs.utexas.edu/~dahlin/projects/bft/ http://www.cs.cornell.edu/lorenzo/papers/sosp05.pdf http://www.cs.northwestern.edu/~fabianb/classes/cs-443-w07/BAR.pdf https://blog.ethereum....
1
vote
2answers
793 views

Ethereum Contract auditing(solidity)

I am a student of Information Security and my teacher has given me the task to know about the details of auditing that is being done on Ethereum smart contracts that are written using solidity. ...
1
vote
1answer
143 views

Using Hardware Security Modules to generate and store private keys on private ethereum / quorum

For a private ethereum networks, has anyone used Hardware Security Modules (HSM) to generate and store Ethereum private keys? I am keen to know how public/private keys are managed without a PKI (...
0
votes
1answer
125 views

Are there any security issues to send token in fallback function?

I want to have a contract that releases an erc-20 token as soon as someone pays ether to contract. Let's call this contract Bid Contract. The abstract code goes like: function askForTokens() public ...
1
vote
1answer
26 views

Strict Balance Equality (Security Issue)

Research Paper, Page-5(Strict Balance Equality)I have read that attacker can use Selfdestruct() and forcibly send ethers to the contracts. My questions are: If Selfdestruct is meant for owner of ...
1
vote
2answers
137 views

Contract variable changes prediction

I believe this is a very simple question, but i couldn't find a direct answer in documentation or google. I'm new to solidity/ethereum and maybe i don't fully understand some core concepts yet. So, ...
0
votes
1answer
170 views

transfer/send error cases

I have a (noob) question on the usage of transfer and send. I have seen that transfer is equivalent to require(x.send(k)); When I use send() I know that I have to check whether there was an error ...
0
votes
1answer
221 views

Threat Model Question - Code Injection / ROP possible in Ethereum Smart Contracts?

I am trying to understand a basic threat model for Ethereum Smart Contracts, to perform some research on how existing attacks techniques may be applied here as well. Is there a risk of a contract with ...
1
vote
1answer
162 views

Implication of hacking into an ethereum node on proof of stake

It is my understanding that in proof of stake, the validator puts up a stake that gets slashed if they don't respond to requests truthfully. In the scenario that someone hacks into your node, wouldn't ...
0
votes
1answer
181 views

Web wallet best practices

I'm putting together an ether/erc20 token wallet in a chrome extension but would like to follow best practices with regards to private key security. I'm using localstorage to handle login and its ...
15
votes
2answers
4k views

Is it safe to reuse Ether addresses?

I believe it's viewed as unsafe in Bitcoin because of the way transactions are signed. Is this also true for Ether addresses?
7
votes
3answers
3k views

Storing and passing encrypted data to another owner

I've been thinking about this situation for quite a while and I wonder if there is a way to solve this on the public Ethereum blockchain. User A stores some data on the blockchain, encrypted in some ...
2
votes
6answers
2k views

Are there any tools that provide security reviews of Solidity code?

Do we have any standardized security scanning tool to go for security code review for solidity language? If not, what all opensource tools are there on which we can relay? Need response urgently.
2
votes
2answers
673 views

Issue with New version of Metamask: Remix cannot detect the Metamask address

I have just installed Metamask version: 6.3.1 Now in Remix, the address of my account in metamask is not detected. The account box in remix remains always blank now (see picture below). Note that I ...
0
votes
3answers
39 views

How do I attack the `Vuln` contract?

How can I steal from Vuln contract? I have made another contract to try to steal from Vuln but it always gives me an error. And I'm not sure how to send the money to my adrress. contract Vuln { ...
1
vote
2answers
326 views

Automatic transaction

I would like to know if it was possible to automatically send any ETH amout to an address "B" just after receiving them on an address "A"? Maybe via a script? I need help
1
vote
1answer
826 views

ETH stolen from two MEW wallets & moved to an unknown address & then to ShapeShift

I recently found out that my ETH funds were stolen from two MEW wallets and moved to an unknown address. Below are addresses of my two MEW wallets. 1) 0x16bf750Ee569F0A173BCCfD7b3F92F9Bb46c6AfC (...
0
votes
1answer
7 views

How to restrict call to inherited public function

I'm using OpenZeppelin library for my project and I need to override some functions for business logic. But my concern is with given example, // contract from library contract A { function ...
1
vote
1answer
29 views

How to access a smart contract function protected by access rights using Web3?

I have a smart contract address for security tokens, and certain functions of it are protected by access rights, for which I have an address to access those functions, however I am not able to figure ...
0
votes
1answer
24 views

Is this implementation of multisig2of3.sol secure? [closed]

I implemented multisig 2 of 3 contract. Please give me feedback on codestyle, security and usability. On codereview there is only two solidity questions, so I posted here. see on github pragma ...
0
votes
1answer
450 views

Setting up MyEtherWallet on iOS device from Coinbase

Can I securely set up and store a MyEthereumWallet on iOS only without an computer? I want to transfer ethers from Coinbase.
1
vote
1answer
46 views

Access manager in Smart Contract

I'm building a service where one can publish a crypted file on the internet which can be accessed and decrypted by people allowed. I don't want to store any crypted key on a server or something. For ...
1
vote
1answer
31 views

Dos with revert

While I was reading a guide on smart contract security (by consensys) I found this: // INSECURE contract Auction { address currentLeader; uint highestBid; function bid() payable { ...
0
votes
0answers
22 views

Understand the `call` opcode in this contract

Hello, I am posting a quick question regarding the functionality this contract: https://etherscan.io/address/6b63ea3612dde97082aab468157950f927618d31#code From the source code, I am not even able to ...
0
votes
1answer
16 views

Understand the potential issue of miner controlled gaslimit

I am aware that smart contracts running on top of EVM can access certain system properties such as timestamp, block number, and gas limit. I am also aware that such properties can be controlled by ...
2
votes
1answer
52 views

function input conditional check

I have a function which is accepting a string argument as input parameter. This string is an IPFS hash and I would like to check that the input is actually just that and not a malicious link or the ...
0
votes
1answer
39 views

msg.sender 'spoofing' when function is public or external

I have a Smart contract where I want only the onwer to call a specific function, for example: function getInfo() view public onlyOwner() returns (address) { return msg.sender; } ..... modifier ...
1
vote
0answers
14 views

Understanding a simple online contract which seems not functional

I am writing to understand the functionality of this contract (https://etherscan.io/address/0x1f14b77e9f4844889fa63bc1e5180c8b90ec18db), this does not look even "functional" to me. Here is the ...
0
votes
1answer
30 views

Leverage short positions in decentralised PoW currencies

Hint I asked this question in a similar style already on bitcointalk and on bitcoin.stackexchange. But in these threads, there are no good answers and I thought maybe it would be better to ask the ...
0
votes
1answer
61 views

The DAO: Stalker Attack - Attacker split from childDAO?

I had a question about the argument in this article Why The Stalker Attack is a Non Issue. In the scenario the article describes, there is a "Victim" and an "Attacker". The Victim tries to split from ...
1
vote
0answers
27 views

What are the drawbacks of layer 2?

The scalability trilemma states that a blockchain can only have two out the following three properties: decentralization, scalability, and security. Layer 2 protocols aim to make Ethereum more ...
2
votes
1answer
58 views

Trustless Inter-chain transaction with Bitcoin- are there any flaws?

Let's say that Alice wants to send Bob 1 BTC, and in return Bob will send Alice 1 ETH. Alice's Bitcoin address is BTC_A, and Alice's Ethereum address is ETH_A. Likewise, Bob owns addresses BTC_B and ...
12
votes
2answers
5k views

How to validate a private key?

I could not find any library that, given an hex value, returns true if the given string is a valid ether private key. Any hints?
2
votes
0answers
46 views

Is there any dynamic symbolic execution tool for smart contract [duplicate]

There is a question (Security analysis tool for Ethereum smart contracts) similar to me, but it presents mostly static analysis tools. I'd like to know if there is any better dynamical analysis tool ...
1
vote
1answer
20 views

Coinbase deposit PLZ HELP [closed]

I deposited $ into Coinbase from my bank account, however the money hasn't cleared yet and it will only be available in 7 days. Do I get the price of ETH BTC LTC when I clicked 'BUY' (although it hasn'...
8
votes
2answers
737 views

Can msg.data be used as an identifier?

I'm looking at the multisig wallet implementation here and I see the usage of sha3(msg.data,block.number) being used as an identifier. What exactly is inside the msg.data and why is it unique enough ...
1
vote
1answer
19 views

Is there any concern for the significant number of nodes being hosted on AWS/ cloud providers?

Just curious if there is any downside that many nodes are being hosted on cloud providers? For example Infura, which supports many nodes and provides a large portion of connections to Ethereum nodes, ...
0
votes
1answer
28 views

Is a function prone to re-entrancy attack even if I set balance to zero within the same function (example included)

Such as in this scenario, is the hackable via re-entrancy? thanks... function withdraw(uint256 money) public { if(money <= balance[msg.sender]) { (bool success, ) = msg.sender.call....