Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

182 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers
148 views

What are best practices for monitoring the OpenEthereum (Parity) logging?

Monitoring of the logging output of the Ethereum clients is essential for stable blockchain operation. Do you have recommendations, experiences and/or lessons learned concerning the logging of ...
user avatar
3 votes
0 answers
673 views

Safe implementation on Solidity 0.8.0 of a withdrawal and a refund

I'm here for asking of a SECURE way to implement on solidity 0.8.0 two functions: 1-Withdrawal() which sends all the ether of the smart contract to the owner address. My current implementation is: //...
user avatar
3 votes
0 answers
1k views

Frontrunning Uniswap horror story transactions

From the Ethereum is a Dark Forest post, the rescue plan was: Deploy a Getter contract which, when called by its owner, would make the burn call ONLY if activated, and otherwise revert. Deploy a ...
user avatar
  • 78.7k
3 votes
0 answers
99 views

Storing Private Keys in IoT Devices

In a network of IoT devices like internet-connected Raspberry Pis which sends transactions to the Ethereum blockchain, the Pis need to be able to access their own Ethereum private keys in order to ...
user avatar
  • 1,077
3 votes
0 answers
148 views

Parity create testing transactions and blocks

For test purposes, I would like to make test blocks including test transactions against main net. For example I would like to make a transaction that sends one ether from 0x1234567... to 0x99999999......
user avatar
3 votes
0 answers
1k views

Is this approach to an ethereum lottery sound and/or novel?

I'm looking at making gambling apps is ethereum. Currently made a contract that can flip a coin. After looking at this question: How can I securely generate a random number in my smart contract? and ...
user avatar
  • 163
3 votes
0 answers
106 views

What is an empty account if the state root is not empty?

"State-bloat" attacks led to an empty account being defined as an account that has zero balance, nonce and code. There was a disagreement on EIP 161: I disagree. An account should be considered ...
user avatar
  • 78.7k
3 votes
0 answers
451 views

What's reverted and not reverted during an Out of Gas exception?

A seemingly crucial question on EIP 158 was unanswered: Unless the empty accounts are deleted even in the case of an EVM exception, if that is the case would that not break the guarantee that ...
user avatar
  • 78.7k
2 votes
0 answers
198 views

admin.peers shows peer info (local and public ip). Is this cause for concern?

I'm connecting to a private blockchain network over the internet using geth. In the console of geth if you run admin.peers it lists both: local_address(internal ip) remote_address(external ip) I have ...
user avatar
2 votes
0 answers
109 views

Even if I own 51% of stake (or have 51% computational power) and try to cheat, can't others still see that my block is invalid?

I'm thinking about how proof of stake works exactly. As I understand, here is how it is secure: I cannot forge a tx where random A pays me X amount because I would need the private keys of A. ...
user avatar
2 votes
1 answer
88 views

In the case the Zerofunctionselector bug, how to know which function NAME has a 0 selector?

Normally, If a smart contract is not affected by the Zerofunctionselector bug, then at the end of the code which makes jump to the target function lies a 0xfe opcode (which result in the smart ...
user avatar
2 votes
0 answers
75 views

What would be the steps required to entirely derive an address with pen and paper?

I'd like to see the steps required to derive an address by hand, with pen and paper, along with an estimate of time required. Is it feasible to derive an address entirely with pen and paper? What ...
user avatar
  • 7,924
2 votes
0 answers
213 views

Why does the new light-client example throw a warning?

Even though I use the new example, lightwallet throws me: The new KeyStore constructor has been deprecated in favor of KeyStore.createVault(), and will be removed in a future version. Read issue #...
user avatar
2 votes
0 answers
143 views

How many people were involved in auditing the DAO code? And how many Eth code auditors are there we can goto?

How many were responsible for auditing the DAO code? It's understandable that bugs arise from any type of code, but having that the DAO was a big project and that once its created it shouldn't be ...
user avatar
1 vote
0 answers
13 views

Using veiw functions to overload Blockchain node

Question: What is stopping me from creating view function with heavy computation (infinite loop). Deploying it on Blockchain and then calling it just so I could overload a Blockchain node that ...
user avatar
  • 765
1 vote
0 answers
7 views

Are there any security concers with using @truffle/hdwallet-provider?

The project I am working on asked if I would remove the usage of @truffle/hdwallet-provider from our project due to security concerns. (One of the previous team members had supposedly concluded it isn'...
user avatar
  • 765
1 vote
0 answers
17 views

Solhint "Explicitly mark all external contracts as trusted" - how to fix

From my smart contract I am emitting an event defined in the interface (that my contract inherits/implements). I keep getting solhint warning about "Explicitly mark all external contracts as ...
user avatar
1 vote
1 answer
38 views

Invalid ENS name in Damn Vulnerable Defi (naive-receiver)

I'm trying to solve the Damn vulnerable Defi challenge's Level 2 - Naive Receiver. We have to drain the user's balance by exploiting the missing access control allowing anyone to be the borrower and ...
user avatar
1 vote
3 answers
68 views

Why sending ether from a smart contract is a security risk?

In this example from the Solidity documentation, inside the bid function, there is this comment: Sending back the money by simply using highestBidder.send(highestBid) is a security risk because it ...
user avatar
1 vote
0 answers
62 views

How to store secure private keys on a server, that are being used for 'gasless' minting using EIP-712 based messages?

NOTE: By 'gasless' I mean that I won't have to mint the tokens for the user, they can mint it themselves provided they have a valid signature. Hi, In my NFT (ERC-721) contract, I'm allowing callers to ...
user avatar
  • 11
1 vote
0 answers
21 views

Transactions that led to the discovery of TheDAO hacker

What are the transactions that led to the discovery of the apparent hacker of TheDAO? What are the primary transactions across the Ethereum, Bitcoin, and Grin blockchains?
user avatar
  • 78.7k
1 vote
0 answers
27 views

How long can a Metamask password be?

How long can the Metamask password be, that encrypts my private key? I would like to make it as long as possible.
user avatar
1 vote
0 answers
24 views

Security for play-to-earn action game

So I'm making a play-to-earn game, that is a web game and its logic runs on the user's machine. After the player finishes a session, the game will call the following mint function: contract GoldCoin ...
user avatar
1 vote
0 answers
43 views

SWC-126 Insuffixient Gas Griefing attack: why not simply requiring a successfull sub-call?

I'm trying to learn more about the SWC Smart Contract Weakness Classification and Test Cases. I'm stuck on understanding SWC-126: https://swcregistry.io/docs/SWC-126. Especially, I don't understand ...
user avatar
  • 111
1 vote
2 answers
88 views

How to do the payment of royalties for a NFT marketplace transaction?

I have read the EIP-2891, but I don't know what is the correct way to approach the payment when the transaction occurs. Initially I thought of doing something like this: (...) // Transfer ...
user avatar
  • 11
1 vote
1 answer
41 views

urgent: dapp wallet connect security issue

i just attempted to connect metamask wallet to dappshubconnect using my 12-word phrase. a qr code appeared and i sent it to someone posing as support for a project i'm invested in. How high is my risk ...
user avatar
  • 11
1 vote
1 answer
108 views

What are the Pros and Cons of Managing Private Keys Directly vs Wallet Extension?

I would like to develop an app on an EVM compatible L1, however MetaMask currently does not have it on its list of supported networks. Hence the only alternative I can think off would be to manage ...
user avatar
  • 240
1 vote
0 answers
449 views

What's the worst that can happen if my metamask password was compromised?

I'm deeply ashamed to say but I got scammed on Discord with a link to a website that was advertising an NFT drop. I clicked on "Login with metamask" and it opened a fake metamask overlay ...
user avatar
  • 113
1 vote
0 answers
18 views

micro-segmentation for blockchain nodes using SPIFFE/SPIRE to avoid rogue nodes

As a blockchain microservices developer, I observed that most, if not all, public blockchain nodes do not authenticate or authorise with each other before communicating. If one may apply principles of ...
user avatar
  • 1,865
1 vote
1 answer
26 views

Is there a need of network additional security measure

I didn't find information about the risk and threat of being connected to the Ethereum network / internet. I was wondering if we would need additional measures such as a firewall, proxy to protect ...
user avatar
  • 13
1 vote
0 answers
97 views

Solidity PRNG with future block hashes: reasonable secure?

I would like someone to tell me if I am neglecting serious security concerns here. I Am trying to create a Solidity slot machine where hash puzzles (leading zeros) are used to get various jackpots. ...
user avatar
1 vote
0 answers
69 views

What would be the cost for one to mine one of his own block?

Smart contract built countermeasures against flash loan attacks. But some of them are just requiring the money to come from an eoa and thus are at risk from peoples who own the funds for themselves. ...
user avatar
1 vote
1 answer
93 views

How can I demonstrate attacks on Quorum-based smart contracts in my local test network?

Currently, I am conducting a research regarding the security and privacy vulnerabilities of Quorum-based smart contracts. However, so far I've been struggling to implement attack vectors in order to ...
user avatar
1 vote
0 answers
36 views

Can the Ethereum network work only with pruned nodes?

So if I got state trie pruning correctly, pruned nodes download all the block headers (so that they can check the PoW of the chain), the transactions of the last k (say 100) blocks (to resist against ...
user avatar
1 vote
1 answer
980 views

Hacked Ethereum wallet -- What do do with staked tokens?

My MetaMask wallet was unfortunately hacked and the hacker drained all of my tokens. I've sent some test tokens back to the wallet to check if the hacker had installed a smart contract to ...
user avatar
  • 11
1 vote
1 answer
6k views

How are Metamask web wallets traceable to owner identity?

When creating a Metamask wallet as a Chrome browser extension, what are all the different identifiers that match the wallet to its owner? Since it takes a password to log into the Metamask wallet, ...
user avatar
1 vote
0 answers
167 views

What s the fake deposit attack affecting some exchanges with erc20?

There are a lot of articles about hacked tokens affecting centralized exchanges only when Googling fake erc20 deposit but I failed to find a reference describing how the attack works technically. The ...
user avatar
1 vote
1 answer
141 views

Flash minting ether security considerations and attacks

Flash loans enable a class of attacks that have not been possible or observed as much in prior systems. Flash minting ether is a concept that is starting to be implemented. See Example of flash ...
user avatar
  • 78.7k
1 vote
0 answers
28 views

Is there any free-to-use scenario builder?

The Compound Protocol has a collection of high-level integration tests, dubbed "scenarios": https://github.com/compound-finance/compound-protocol/tree/v2.8.1/spec Which look like this: Test &...
user avatar
1 vote
0 answers
25 views

Cost of forking Augur

Augur Version 2 is scheduled for launch on July 28th 2020. How can the cost of forking Augur version 2 (by disputing a market resolution) be calculated in REP? How dies this cost compare to the cost ...
user avatar
1 vote
0 answers
210 views

How does MetaMask secure / store unlocked accounts?

I understand that MetaMask stores the encrypted vault somewhere like C:\Users\USER_NAME\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn ...
user avatar
  • 641
1 vote
1 answer
344 views

State only node

Is it possible for the network clients to just keep the latest network state (without keeping track of the past transactions) while not harming the network security? That is, is it really needed to ...
user avatar
1 vote
0 answers
626 views

Sending secure transactions using web3.py

An ethereum account I had has been hacked, where whenever I send it, say, 0.1 eth, some evil bot immediately sends 0.0009 eth from that account to a dummy account, and then spends the remaining 0.0991 ...
user avatar
1 vote
1 answer
226 views

How does this function potentially violates the Checks-Effects-Interaction pattern?

I am developing a smart contract that integrates with the DAI stable coin. In the function below, you can see that I have followed the check effects interaction pattern, so how come I still get a ...
user avatar
1 vote
0 answers
74 views

How dangerous is this: number of contracts contain a function like "approveandcall" which lets anyone call any contract (some thoughts?)

The most common implementation is as follows: function approveAndCall(address _spender, uint256 _value, bytes _extraData) public returns (bool success) { tokenRecipient spender = tokenRecipient(...
user avatar
1 vote
0 answers
38 views

Is there a curated list of known security vulnerabilities related to escrow?

In Factories Improve Smart Contract Security, Steve Marx says that: This bug was hand-picked to show the benefit, but this bug is representative of a large class of bugs around escrow. In my ...
user avatar
1 vote
0 answers
102 views

Help hacking this contract

This is a very simple contract that I can't hack and I'm stuck, I need some help to get the concepts right. pragma solidity ^0.4.10; contract SimpleToken { mapping(address => uint) public ...
user avatar
1 vote
1 answer
134 views

Risk of Messages Not Having a Signature

As per my understanding transactions are signed before sending to Ethereum. Else, no transfer of Ether will happen. However, messages sent to Smart Contracts (SC) aren't signed (e.g., using methods....
user avatar
1 vote
0 answers
33 views

How exactly theᴅᴀᴏ reentrancy hack was performed without having weiGiven>0 nor IsAllowed(WithdrawAddress)?

The well known ᴅᴀᴏ hack didn’t affect ether balances of theᴅᴀᴏ but balances of rewardAccount. That’s why I’m talking about the hack version which affected contract balances of theᴅᴀᴏ itself. With ...
user avatar
1 vote
1 answer
107 views

adaptive vs. non-adaptive adversaries? Is there a precise, unique and general definition? (Updated)

In this Ethereum github page (Link to the page: https://github.com/ethereum/wiki/wiki/Sharding-FAQ#what-are-the-security-models-that-we-are-operating-under) there is a very brief definition of the ...
user avatar
  • 2,508