Questions tagged [security]
Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.
838
questions
12
votes
1
answer
2k
views
I got scammed or suspect scam on Ethereum. What to do?
This is a general question and answer on ethereum.stackexchange.com to all "I got scammed, please help" posts.
This applies to you if you think:
You have been scammed
You think something ...
- 21.7k
2
votes
4
answers
1k
views
How can one secure Web3 JSON-RPC API endpoint?
When using geth as client and web3(javascript api) to interact with it through a web browser, other nodes in the network can access the client given the IP and the port on which the client is running. ...
- 21.7k
0
votes
1
answer
18
views
Are multiplications after division UNSAFE?
I have a smart contract which essentially does this:
uint256 tokenRate = _pair.a2 * PRECISION_FACTOR / _pair.a1;
uint256 toSend = _amount * tokenRate / PRECISION_FACTOR;
uint256 feeToOwner2 = toSend ...
- 187
1
vote
1
answer
18
views
How prevent of attack in Ethereum
I hope you are well. The topic of my thesis is to increase security in blockchain-based IoMT (Internet of Medical Things). I aim to present new ideas to reduce attacks in the blockchain, considering ...
- 21.7k
0
votes
1
answer
422
views
When calling eth_getLogs, should I worry if a block is mined?
I call eth_getLogs to store some data in the database. In https://eth.wiki/json-rpc/API#eth_getLogs it says:
fromBlock: QUANTITY|TAG - (optional, default: "latest") Integer block number, or &...
CommunityBot
- 1
0
votes
1
answer
367
views
Security Implications of allowing remote RPC connections to Geth Node
What are the security Implications of allowing remote RPC connections to Geth Node?
If one absolutely needs to allow remote rpc connections for web3 connection, how can one do this while securing the ...
CommunityBot
- 1
2
votes
1
answer
33
views
Is there a way to stop wallet homomorph attacks without ditching the create2 opcode?
Losses from create2 wallets that look similar to recently active wallets has surpassed $60m:
https://gbhackers.com/create2-bypass-wallet-security-alerts/
Even today I made a transaction, and noticed ...
- 41
2
votes
3
answers
439
views
Proxy function clashing - what kind of danger comes exactly with it?
I read that if I am using proxy, there is a chance of function clashing. Let's say in my contract there is a function with a signature:
proxyOwner()
...
CommunityBot
- 1
1
vote
1
answer
1k
views
Hacked Ethereum wallet -- What do do with staked tokens?
My MetaMask wallet was unfortunately hacked and the hacker drained all of my tokens. I've sent some test tokens back to the wallet to check if the hacker had installed a smart contract to ...
CommunityBot
- 1
1
vote
1
answer
312
views
Fake BUSD transcation sent from my wallet (not fake 0 token scam)!
Transaction Hash: 0x7800fb4d9345fc7e8b2794a479f414948eb1a9126e14daff11d1802440996a68
The hackers sent fake busd token (with >0 amount) from multiple victims wallet to another wallet without any ...
CommunityBot
- 1
0
votes
1
answer
53
views
What is "pig butchering" scam?
What is the "pig butchering" scam? Why is it called "pig butchering"? What are some of its elements? How bad can it get?
20
votes
3
answers
15k
views
How to validate a private key?
I could not find any library that, given an hex value, returns true if the given string is a valid ether private key.
Any hints?
- 11
2
votes
2
answers
357
views
How does this function potentially violates the Checks-Effects-Interaction pattern?
I am developing a smart contract that integrates with the DAI stable coin. In the function below, you can see that I have followed the check effects interaction pattern, so how come I still get a ...
CommunityBot
- 1
0
votes
0
answers
6
views
Would this work to add a check that a signature hasn't already been used?
I'm working on an exercise to learn smart contract security, and I am trying to add a check that a signature has not been previously used to this withdraw function. Below I put the original function ...
- 41
2
votes
1
answer
14
views
Is it profitable for a miner to manipulate blocks in a small Ethereum project?
In the context of my blockchain project, I’m using the blockhash() function to generate randomness. However, I’m concerned about the potential vulnerability of this method. I’d like to know if, in a ...
- 1,408
3
votes
1
answer
39
views
Questions about security of the cold wallets
While I was studying about the difference between the hot wallet and cold wallet, I got some questions about their security.
If I create one private key using a cold wallet then restore the same key ...
0
votes
0
answers
4
views
Data Based and System Security
Over the last year or so, ever since I started messing around with the blockchain protocol, I my system, database, seems to have gotten hacked time and time again.
I have learned a great deal with ...
0
votes
1
answer
35
views
How to download and install Echidna?
I have just started learning echidna but i havent found any detailed information of how to install and setup echidna in WSL.
- 187
1
vote
2
answers
110
views
Can your Metamask get hacked by signing a message, no gas?
If I log into a new project with Metamask, and the operation costs no gas, can I get hacked?
Does no gas mean you are safe when signing with Metamask?
- 101
5
votes
3
answers
1k
views
Best way to lock tokens for investors vesting period
What would be the most convenient way for our team to lock tokens for a vesting period for a relatively large number of wallets? (30+)
We've considered team.finance as well as writing our own contract ...
- 17.3k
0
votes
1
answer
42
views
To what extent was the block hash malleable under proof-of-work?
To emphasise, I’m solely interested in blocks prior to the transition to PoS.
Given that a miner making any change to the block header would have resulted in a completely different hash, my thinking ...
- 31k
1
vote
1
answer
30
views
Is it secure to use multiple admin
im trying to do multiple admin system in my solidity and here is example
//SPDX-License-Identif`ier: MIT
pragma solidity 0.8.15;
import "@openzeppelin/contracts/access/Ownable.sol";
...
- 1,408
0
votes
1
answer
38
views
Securities Token contract
I want to learn how to create a security token. I am not able to find any sources to teach myself how to. Please, can anyone help me with this situation?
0
votes
1
answer
638
views
Hacked Eth Account - What do I do with my staked tokens?
Unfortunately my Metamask wallet was hacked today on the Metamask app which I'm devasted about. I tried connecting Pancake Swap to it and it popped up asking for my words which I stupidly gave. The ...
1
vote
1
answer
1k
views
Automatic transaction
I would like to know if it was possible to automatically send any ETH amout to an address "B" just after receiving them on an address "A"? Maybe via a script? I need help
CommunityBot
- 1
1
vote
0
answers
38
views
Creating a sufficiently random number via computation entropy without an oracle
I am creating a token that requires a sufficiently random number for an internal lottery.
uint randomX;
function semirandomize(uint prevRandom, uint time) private view returns (uint) {
...
- 79
0
votes
2
answers
90
views
ERC20 token smart contract check
I updated my smart contract code according to the explanations you gave and the instructions you gave. Please, if possible, check the rewritten code again and give your general opinion, is this smart ...
- 63
78
votes
4
answers
65k
views
<address>.send vs <address>.transfer best practice usage?
I noticed that address's offer two member functions that perform the transfer of ether to the specified address. send returns false upon failure and transfer raises an exception. In the Solidity ...
- 17.3k
0
votes
1
answer
691
views
ERC20 vulnerability? Executing transferFrom undesirably
Say I have a contract called MyContract, and I require to send 100000 DAI to it. Ideally, I'd firstly call approve(<address of A>, 100000e18) in DAI's contract itself. Secondly, I'd execute, for ...
CommunityBot
- 1
0
votes
1
answer
22
views
Use offchain date time
in my contract, I need to do something based on time, and this is quite sensitive, and as we know, you cannot rely on the block.timestamp because it can be changed, I want to know if there is a way ...
1
vote
2
answers
416
views
How did this address steal my Ethereum ERC-20 Tokens?
A person on Twitter told me about this DApp that gives her 1% ROI each day and since I was new to crypto and her lies was really believable to me and I had really big FOMO. I first put 100 USDT into ...
CommunityBot
- 1
0
votes
3
answers
2k
views
Signing transaction on frontend and sending on backend server
Hi I'm making an NFT auction site similar to OpenSea to learn blockchain technology. But I have some security concerns about sending transactions on the frontend of my application because if a user ...
CommunityBot
- 1
0
votes
1
answer
497
views
Setting up MyEtherWallet on iOS device from Coinbase
Can I securely set up and store a MyEthereumWallet on iOS only without an computer? I want to transfer ethers from Coinbase.
CommunityBot
- 1
1
vote
1
answer
36
views
Building Cryptocurrency Tracking system for monitoring stolen cryptocurrency transactions
When hackers steal tokens from an account, what they generally do is divert the flow of tokens via multiple proxy accounts making it complicated for the cyber-forensics department to track final ...
- 322
10
votes
2
answers
5k
views
Storing private data on the ethereum blockchain
I plan to make an app utilising Ethereum that will store private data about a user. Eventually, I want this data to be accessible by selected users.
I have seen conflicting answers & discussions ...
- 1
1
vote
0
answers
31
views
How to run a script which requires a private key completely in a browser?
For a non-technical person I need to create a page on my website, in the admin area, in which he'd regularly do stuff that normally is done on local machine only. That is, a person doesn't want to go ...
- 49
2
votes
1
answer
104
views
Does a Rollup transaction need the parameter 'nonce'?
Recently I am learning Rollups, and one thing makes me confused is that, Does the compressed transaction in a batch need the parameter nonce?
Here in on-chain-scaling-to-potentially-500-tx-sec-through-...
- 55
0
votes
0
answers
27
views
Connect & interact with dApp without wallet connection
I have a question regarding the issues I am facing on my current project. I am building NFT marketplace on the Polygon network.
The specific requirement is we should allow the users can interact with ...
- 13
0
votes
2
answers
39
views
What are the best up-to-date secure approaches of generating pseudorandom number in Solidity? [duplicate]
I am thinking about creating a lottery with more than one winner and one round for users. Please don't consider usual 'commit-reveal' scheme. However, person can claim rewards on their own at the end ...
- 2,204
0
votes
1
answer
538
views
Threat Model Question - Code Injection / ROP possible in Ethereum Smart Contracts?
I am trying to understand a basic threat model for Ethereum Smart Contracts, to perform some research on how existing attacks techniques may be applied here as well. Is there a risk of a contract with ...
CommunityBot
- 1
1
vote
1
answer
7k
views
How are Metamask web wallets traceable to owner identity?
When creating a Metamask wallet as a Chrome browser extension, what are all the different identifiers that match the wallet to its owner? Since it takes a password to log into the Metamask wallet, ...
CommunityBot
- 1
0
votes
1
answer
297
views
Retrieving address of contract owner and making call to all smart contract methods
guys need some help related to enforcing security more on the lines of authentication in my smart contract.
So I have a smart contract that has an owner as the deployers address. This owner will be ...
- 25
1
vote
1
answer
26
views
What is a good use case for .call functions' ability to pass a function call?
Following up on this thread, I wish to understand what will be a good use case using the feature to call a function in .call{}() ?
- 31k
2
votes
1
answer
299
views
Does a hardware wallet always generate the same seed phrase?
If I buy a new Ledger out of the box (untampered by the seller) and generate its seed phrase (Attempt #1), but then format the device to factory settings in order to once again re-generate a seed ...
- 1
2
votes
1
answer
101
views
MIME types in Ethereum
Yesterday evening, an individual(at a french meetup haha) asked me what ethereum was and kept asking me if there was something similar to MIME types on Ethereum. I did not know what MIME types were ...
- 6,763
0
votes
1
answer
30
views
What is an re-entrancy attack and how does it work?
With the recent exploit on the omnipools on Conic Finance. The hacker used an exploit called: re-entrancy attack. How does it work explained in layman terms?
And what should smart contract auditors ...
- 1,462
1
vote
2
answers
7k
views
How this modifier nonReentrant work？
It's the source code from address 0x0d4535644fFeC908e39a711A01852Be40Bfe1C97, can the modifier nonReentrant prevent the re-entrance vulnerability?
contract ReentrancyGuard {
/// @dev counter to allow ...
- 1
1
vote
1
answer
104
views
What are the possible security threats when using mappings in Solidity?
Does the use of a nested mapping possess any threats to the security of the contract below?
contract Users {
struct User {
address payable regAddress;
uint64 timestamp;
...
- 4,147
2
votes
1
answer
83
views
QuickAlerts Help!
I have been using QuickAlerts to track activities on my smart contract and receive a WebHook in my Discord server. How can I make sure that the WebHook is indeed coming from QuickAlerts and not a ...
19
votes
3
answers
10k
views
send VS call - differences and when to use and when not to use
Can somebody please explain the differences between using a send and call for contracts and when to use and not use these different methods?
For example :
msg.sender.send(number);
msg.sender....
