Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
0 votes
1 answer
15 views

Is there a recommended maximum size for an input array in a Solidity smart contract?

// SPDX-License-Identifier: MIT pragma solidity ^0.8.0; import "./interfaces/IERC20.sol"; contract Airdrop { function airdropToken( address _token, address[] calldata ...
0 votes
2 answers
27 views

Are Chainlink keepers a security liability?

I've previously read some of Buterin's posts and he's been especially critical of cross-chain bridges. I know they aren't bridges where digital assets are stored non-natively, but are Chainlink ...
1 vote
3 answers
30 views
+200

Is it possible for a callee to DOS a function call if the caller ignores the success value?

Consider the following function: uint256 mySpecialNumber = 0; function foo(address callee, uint256 newNumber) public { mySpecialNumber = newNumber; // make a low level call to the bar() function ...
0 votes
0 answers
18 views

Is it gas efficient to call another contract's external function in a loop?

I am trying to create a staking protocols where rewards and staking are separate. But there are multiple tokens that get rewarded and I need to update each of them in a loop. Now, my question is how ...
0 votes
2 answers
822 views

Signing transaction on frontend and sending on backend server

Hi I'm making an NFT auction site similar to OpenSea to learn blockchain technology. But I have some security concerns about sending transactions on the frontend of my application because if a user ...
3 votes
3 answers
394 views

Ethernaut level 20 Denial probably no longer solvable. Why?

I solved all levels of Ethernaut game except level 20 Denial: https://ethernaut.openzeppelin.com/level/0xcE1BB92eeb71AF5Fec09D38B0c854d55285f6e04 Eventually, I gave up and looked up the solution on ...
0 votes
1 answer
20 views

If it Safe to Expose Geth RPC to Public Internet

I just spun up a geth node on my home server with flags --http.addr=0.0.0.0 --http.vhosts=* --http.corsdomain=* --ws --ws.origins=* --ws.addr=0.0.0.0. I am using a nginx reverse proxy to make it ...
0 votes
0 answers
9 views

Ethernaut #16 Preservation. Contract loaded from address in Remix fails to fully interact with contract. Strange bug

Ethernaut's Preservation is solved by exploiting that the delegate call to LibraryContract in setFirstTime() and setSecondTime() in fact changes the first variable in Preservation itself (not in ...
0 votes
0 answers
25 views

Can you prevent a `revert` from happening?

I was wondering if there is a way to avoid the revert statement in this code example. Or to put it another way, could you write a smart contract that allows arbitrary operations as long as you have a ...
0 votes
1 answer
54 views

How to fix vulnerability in solidity contract

I have recently deployed a contract on the BSC mainnet that got drained of all the funds in it, but I can't seem to find where in my contract the loophole is to know how it got drained so it doesn't ...
1 vote
1 answer
6k views

How are Metamask web wallets traceable to owner identity?

When creating a Metamask wallet as a Chrome browser extension, what are all the different identifiers that match the wallet to its owner? Since it takes a password to log into the Metamask wallet, ...
0 votes
0 answers
19 views

Ethernaut #11 Elevator, Gas estimation failed

I'm trying to solve Ethernaut #11 Elevator. My solution works when I deploy a copy of the instance contract by myself on Remix VM, but when I try it on the real instance on the Rinkeby network, using ...
0 votes
1 answer
409 views

Threat Model Question - Code Injection / ROP possible in Ethereum Smart Contracts?

I am trying to understand a basic threat model for Ethereum Smart Contracts, to perform some research on how existing attacks techniques may be applied here as well. Is there a risk of a contract with ...
0 votes
0 answers
20 views

Security risks of calling the approve method of an ERC-20

Looking into the uniswap code of https://docs.uniswap.org/protocol/guides/providing-liquidity/the-full-contract: function increaseLiquidityCurrentRange( uint256 tokenId, uint256 amountAdd0, ...
0 votes
1 answer
10 views

How to ensure the security of computation and transmition on Smart Contracts?

Suppose there is a smart contract with a bidding function, and the bidder can send the bid price to the smart contract after encrypting it. When the auction is over, a trusted third party sends the ...
0 votes
0 answers
13 views

Decrypt a message on-chain with a perfect secrecy

Does anyone have a good solution to decrypt a message on-chain, with a perfect secrecy and/or with a weak/re-used key? I found a solution (CTR encryption mode) in a previous post but I don't ...
1 vote
3 answers
68 views

Why sending ether from a smart contract is a security risk?

In this example from the Solidity documentation, inside the bid function, there is this comment: Sending back the money by simply using highestBidder.send(highestBid) is a security risk because it ...
0 votes
0 answers
43 views

Protect Infura ID from being stolen and abused

I'm using an Infura API key for my dApp's "Connect Wallet" integration with Web3Modal Key: Relevant Codebase: import Web3Modal from 'web3modal' import WalletConnect from '@walletconnect/...
0 votes
0 answers
12 views

How would ethereum migrate a whole transaction history after The Merge?

I have read press release of upcoming The Merge and face with promise to save a whole transaction history without tech details: No history is lost. As Mainnet gets merged with the Beacon Chain, it ...
0 votes
1 answer
31 views

Question about ethereum security

I want to ask a question. As far as I know, if we capture the majority of the nodes of the blockchain, we can get the control of it. In web3 terminology, our aim is to recover internet from big tech ...
0 votes
1 answer
241 views

one wallet address, multiple users, what is the best way to keep the private key secured?

I would like to develop an application using the web3j. However, it needs to be just one wallet that multiple users will deposit and withdraw from. The allowances are kept in a centralized database. ...
2 votes
1 answer
42 views

How to encode message using public key ETH address?

I want to send an encrypted message to a specific ETH address via the blockchain. Hello, my secret. Can I encrypt this message in the browser with the public key of the recipient's address? I ...
0 votes
0 answers
186 views

My metamask wallet was hacked and i need to change passphrase

I have been stolen two and more ethers today from my metamask passphrase.How can i change the passphrase of the ether wallet so i will be able to charge more ethers to this address?I have tokens and ...
1 vote
0 answers
13 views

Using veiw functions to overload Blockchain node

Question: What is stopping me from creating view function with heavy computation (infinite loop). Deploying it on Blockchain and then calling it just so I could overload a Blockchain node that ...
0 votes
1 answer
40 views

Is this implementation of Openzeppelin's ECDSA module secure?

I am quite new to ECDSA signatures and the exact way they work. In an attempt to understand it better I have tried experimenting with it. I am trying to create an ERC20 mint function using ...
0 votes
0 answers
16 views

Why the function which cannot send ether still need nonReentrant()?

I have a look at the code of a smart contract at https://etherscan.io/address/0x101816545f6bd2b1076434b54383a1e633390a2e#code. And i found that it utilize the nonReentrant() modifier to protect some ...
0 votes
1 answer
293 views

Security Implications of allowing remote RPC connections to Geth Node

What are the security Implications of allowing remote RPC connections to Geth Node? If one absolutely needs to allow remote rpc connections for web3 connection, how can one do this while securing the ...
0 votes
1 answer
36 views

Clone a Smart Contract

I'm an artist trying to publish his own contract. I don't have solidarity knowledge, but I can read/understand codes in general. So I found this collection minted yesterday: https://etherscan.io/...
3 votes
1 answer
268 views

Using Hardware Security Modules to generate and store private keys on private ethereum / quorum

For a private ethereum networks, has anyone used Hardware Security Modules (HSM) to generate and store Ethereum private keys? I am keen to know how public/private keys are managed without a PKI (...
1 vote
1 answer
368 views

Why is there a sandwich attack on the bsc.?How did it happen?

https://bscscan.com/tx/0xeef7b93a99dc9ba7285e495ac3fa61b704762d032669fc038120501d105d26c4 https://bscscan.com/tx/0x36a3b0323312e83a3ce2ce6e0ed390be844c3d12635031417f7fad6eb23766a1 https://bscscan.com/...
1 vote
1 answer
27 views

is pull over push pattern recommended for erc20 withdrawal too?

I had a chance to read the pull over push pattern for transferring/withdrawing ethers, but i'm not sure if i need to apply this for erc20 transfers. i.e. function buy(uint256 _someId, uint256 _price)...
0 votes
1 answer
21 views

i want to add restriction on the modification variable

i want to share my code and see if someone help me to understand if it's a good practice ? i would like to restrited the modification of the number. // SPDX-License-Identifier: MIT pragma solidity 0.8....
1 vote
0 answers
9 views

Are there any security concers with using @truffle/hdwallet-provider?

The project I am working on asked if I would remove the usage of @truffle/hdwallet-provider from our project due to security concerns. (One of the previous team members had supposedly concluded it isn'...
0 votes
3 answers
3k views

What wallet do support 25-word (24 words + extra word) seed phrases

I know only one wallet is supported 25 words seed phrase (24 words + extra word) is MEW. Are there else wallets that support 25 words seed phrases? UPDATE: I'm interested in wallets what can import/...
7 votes
3 answers
1k views

What is a Sybil attack?

The term "Sybil Attack" comes up often when discussing network security with researchers. What is it? How much of a concern is it to the Ethereum network? What are some effective ways to prevent it?
1 vote
1 answer
990 views

Hacked Ethereum wallet -- What do do with staked tokens?

My MetaMask wallet was unfortunately hacked and the hacker drained all of my tokens. I've sent some test tokens back to the wallet to check if the hacker had installed a smart contract to ...
0 votes
1 answer
231 views

Are there any security issues to send token in fallback function?

I want to have a contract that releases an erc-20 token as soon as someone pays ether to contract. Let's call this contract Bid Contract. The abstract code goes like: function askForTokens() public ...
0 votes
1 answer
316 views

transfer/send error cases

I have a (noob) question on the usage of transfer and send. I have seen that transfer is equivalent to require(x.send(k)); When I use send() I know that I have to check whether there was an error ...
3 votes
2 answers
3k views

What exactly is a proxy contract and why is there a security vulnerability involved in it?

I was looking at the recent FE badger DAO exploit and this Twitter thread in it https://twitter.com/CryptoCatVC/status/1466380960648380419?s=20 One piece of advice the author gives before signing a ...
0 votes
1 answer
52 views

Reentrancy Ethernaut Challenge

I have been trying to pass the Reentrancy attack challenge of Ethernaut. Hence, I am creating this issue to ask help from anybody who knows where is the problem coming from. First of all, here is the ...
0 votes
2 answers
154 views

How do you make a signature valid for only one transaction?

I asked this question before but I worded it ambiguosly. I have a function in a smartcontract that should only be accessible by users who have a signature, issued by the contract owner. The goal is, ...
0 votes
0 answers
33 views

Make user withdraw tokens

As a best -and most secure- practice, how do you make an user to withdraw tokens from your contract, without them having to initiate the withdrawal procedure (aka calling a withdraw function), instead ...
0 votes
0 answers
16 views

How to bypass the openzeppelin-contracts Address.sol check and "tx.origin == _caller"

I am trying to create a smart contract for to mint NFT and token for security purpose, but I often got stuck with the contract checking, does anyone know if I can bypass those checking?
1 vote
1 answer
226 views

How does this function potentially violates the Checks-Effects-Interaction pattern?

I am developing a smart contract that integrates with the DAI stable coin. In the function below, you can see that I have followed the check effects interaction pattern, so how come I still get a ...
0 votes
1 answer
39 views

publishing blocks with delay

this is rather a simple and fundamental question but nevertheless i couldn't find any solution for it and now I'm worried if it can cause real attacks to slow blockchains. imagine in a form of ...
1 vote
1 answer
1k views

Automatic transaction

I would like to know if it was possible to automatically send any ETH amout to an address "B" just after receiving them on an address "A"? Maybe via a script? I need help
3 votes
4 answers
2k views

Slither Tool Error On Contract That Inherit From Openzeppeling

Hey Guys Hi ALl ! *I'm trying to use SLITHER (analizy tool ) but when i try to use it on a contract what inherit from Openzeppelin it give me this error(photo) Error: Source "@openzeppelin/...
0 votes
2 answers
418 views

Ether was stolen from my account - Why and how?

I was recently the victim of a hack consisting in withdrawing me all my wallet without being able to do anything. Basically someone paid me in ETH to my address (using my public key) and then a few ...
0 votes
1 answer
25 views

Is there a mechanism or app or technology to verify user controls public key?

I read somewhere that there is a way for me to verify that a given individual owns a public key. Unfortunately, I don't know where that article was nor what term to search for. For example, I want to ...
0 votes
2 answers
17 views

Encryption or hashing with data

The data which we send via Ethereum blockchain , is it ecrypted and sent to sender only & never stored on blockchain OR is it hashed ? Hashing is a one way process . It means that the data once ...

1
2 3 4 5
16