Questions tagged [security]
Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.
190
questions with no upvoted or accepted answers
5
votes
0
answers
169
views
What are best practices for monitoring the OpenEthereum (Parity) logging?
Monitoring of the logging output of the Ethereum clients is essential for stable blockchain operation.
Do you have recommendations, experiences and/or lessons learned
concerning the logging of ...
- 458
4
votes
0
answers
137
views
BLS signatures and the Splitting Zero attack
In 2021 security researcher Quan Thoi Minh Nguyen published two papers ("0" and "Attacks and weaknesses of BLS aggregate signatures") where he highlighted some security weaknesses ...
- 56
4
votes
0
answers
164
views
Why does Ownable.sol from OpenZeppelin rely so much on the use of functions?
I wondered why OpenZeppelin relies so much on the use of functions when, at first glance, they seem unnecessary for such elementary operations. For example, take the Ownable.sol contract. Why isn't ...
- 73
4
votes
0
answers
1k
views
Frontrunning Uniswap horror story transactions
From the Ethereum is a Dark Forest post, the rescue plan was:
Deploy a Getter contract which, when called by its owner, would make
the burn call ONLY if activated, and otherwise revert.
Deploy a ...
eth♦
- 86.3k
4
votes
0
answers
537
views
What's reverted and not reverted during an Out of Gas exception?
A seemingly crucial question on EIP 158 was unanswered:
Unless the empty accounts are deleted even in the case of an EVM
exception, if that is the case would that not break the guarantee that
...
eth♦
- 86.3k
3
votes
0
answers
29
views
Ethereum sharding minimum committee size of 111 for safety
I am currently researching the minimum committee size required for Ethereum sharding. According to Vitalik, the minimum number of validators in a committee associated with a malicious committee ...
3
votes
0
answers
22
views
For anomaly detection on blockchain networks, what are some key differences between Ethereum and Bitcoin?
I'm currently exploring anomaly detection techniques on the Ethereum networks. From existing research papers available, I realized that anomaly detection research have been mostly done separately ...
- 43
3
votes
0
answers
184
views
How to store secure private keys on a server, that are being used for 'gasless' minting using EIP-712 based messages?
NOTE: By 'gasless' I mean that I won't have to mint the tokens for the user, they can mint it themselves provided they have a valid signature.
Hi,
In my NFT (ERC-721) contract, I'm allowing callers to ...
- 31
3
votes
0
answers
454
views
admin.peers shows peer info (local and public ip). Is this cause for concern?
I'm connecting to a private blockchain network over the internet using geth.
In the console of geth if you run admin.peers it lists both:
local_address(internal ip)
remote_address(external ip)
I have ...
3
votes
0
answers
779
views
Safe implementation on Solidity 0.8.0 of a withdrawal and a refund
I'm here for asking of a SECURE way to implement on solidity 0.8.0 two functions:
1-Withdrawal() which sends all the ether of the smart contract to the owner address. My current implementation is:
//...
3
votes
0
answers
112
views
Storing Private Keys in IoT Devices
In a network of IoT devices like internet-connected Raspberry Pis which sends transactions to the Ethereum blockchain, the Pis need to be able to access their own Ethereum private keys in order to ...
- 1,167
3
votes
0
answers
157
views
Parity create testing transactions and blocks
For test purposes, I would like to make test blocks including test transactions against main net.
For example I would like to make a transaction that sends one ether from 0x1234567... to 0x99999999......
- 4,740
3
votes
0
answers
1k
views
Is this approach to an ethereum lottery sound and/or novel?
I'm looking at making gambling apps is ethereum. Currently made a contract that can flip a coin. After looking at this question:
How can I securely generate a random number in my smart contract?
and ...
- 173
3
votes
0
answers
136
views
What is an empty account if the state root is not empty?
"State-bloat" attacks led to an empty account being defined as an account that has zero balance, nonce and code.
There was a disagreement on EIP 161:
I disagree. An account should be considered ...
eth♦
- 86.3k
2
votes
1
answer
16
views
Is it profitable for a miner to manipulate blocks in a small Ethereum project?
In the context of my blockchain project, I’m using the blockhash() function to generate randomness. However, I’m concerned about the potential vulnerability of this method. I’d like to know if, in a ...
- 21
2
votes
1
answer
109
views
How can ERC20 tokens be obtained in a local hardaht forked environment?
I've been learning about ethereum for a short time, besides my English could be better; if I'm wrong about something, please correct me. 😁 I am trying to test the interaction of different contract ...
- 21
2
votes
0
answers
34
views
Using veiw functions to overload Blockchain node
Question: What is stopping me from creating view function with heavy computation (infinite loop). Deploying it on Blockchain and then calling it just so I could overload a Blockchain node that ...
- 2,370
2
votes
0
answers
98
views
SWC-126 Insuffixient Gas Griefing attack: why not simply requiring a successfull sub-call?
I'm trying to learn more about the SWC Smart Contract Weakness Classification and Test Cases. I'm stuck on understanding SWC-126: https://swcregistry.io/docs/SWC-126. Especially, I don't understand ...
- 121
2
votes
0
answers
131
views
Even if I own 51% of stake (or have 51% computational power) and try to cheat, can't others still see that my block is invalid?
I'm thinking about how proof of stake works exactly.
As I understand, here is how it is secure:
I cannot forge a tx where random A pays me X amount because I would need the private keys of A. ...
- 121
2
votes
0
answers
32
views
Is there any free-to-use scenario builder?
The Compound Protocol has a collection of high-level integration tests, dubbed "scenarios":
https://github.com/compound-finance/compound-protocol/tree/v2.8.1/spec
Which look like this:
Test &...
- 18.5k
2
votes
0
answers
308
views
How does MetaMask secure / store unlocked accounts?
I understand that MetaMask stores the encrypted vault somewhere like
C:\Users\USER_NAME\AppData\Local\Google\Chrome\User Data\Default\Local
Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
...
- 701
2
votes
2
answers
380
views
How does this function potentially violates the Checks-Effects-Interaction pattern?
I am developing a smart contract that integrates with the DAI stable coin. In the function below, you can see that I have followed the check effects interaction pattern, so how come I still get a ...
2
votes
3
answers
553
views
Proxy function clashing - what kind of danger comes exactly with it?
I read that if I am using proxy, there is a chance of function clashing. Let's say in my contract there is a function with a signature:
proxyOwner()
...
- 791
2
votes
0
answers
81
views
What would be the steps required to entirely derive an address with pen and paper?
I'd like to see the steps required to derive an address by hand, with pen and paper, along with an estimate of time required.
Is it feasible to derive an address entirely with pen and paper?
What ...
- 8,588
2
votes
0
answers
216
views
Why does the new light-client example throw a warning?
Even though I use the new example, lightwallet throws me:
The new KeyStore constructor has been deprecated in favor of KeyStore.createVault(), and will be removed in a future version. Read issue #...
- 11.7k
2
votes
0
answers
150
views
How many people were involved in auditing the DAO code? And how many Eth code auditors are there we can goto?
How many were responsible for auditing the DAO code? It's understandable that bugs arise from any type of code, but having that the DAO was a big project and that once its created it shouldn't be ...
- 4,800
1
vote
0
answers
17
views
Ethereum desktop or mobile wallets for privacy
Are there any Ethereum wallets or forks designed for user privacy?
A desktop or mobile wallet that only makes calls to a local node, and has logging disabled by default?
Is there a fork of MetaMask ...
eth♦
- 86.3k
1
vote
0
answers
435
views
What are examples of high-liquidity ERC777 tokens on ETHEREUM? Any other token standards apply too, as long as there's a beforeTransfer callback
I'm looking to make a list of popular tokens that implement hooks on transferFrom(address owner, address receiver, uint256 amount) and are deployed on the Ethereum blockchain in particular.
For ...
- 1,484
1
vote
0
answers
58
views
Creating a sufficiently random number via computation entropy without an oracle
I am creating a token that requires a sufficiently random number for an internal lottery.
uint randomX;
function semirandomize(uint prevRandom, uint time) private view returns (uint) {
...
- 125
1
vote
0
answers
65
views
How to run a script which requires a private key completely in a browser?
For a non-technical person I need to create a page on my website, in the admin area, in which he'd regularly do stuff that normally is done on local machine only. That is, a person doesn't want to go ...
- 49
1
vote
1
answer
132
views
How to prevent replay attacks on ZK Proof Transactions?
Alice wants to prove a statement (let's say, she has a secret value x such that x * 2 = 10) to Bob without revealing x).
Alice generates a proof using the ZK-Snark protocol.
const { proof, ...
- 296
1
vote
2
answers
61
views
Ways to earn ETH passive income
I have a decent amount of ETH in my cold wallet (<32 ETH). These bag of ETH is my HODL bag, meaning that I don't want to spend it and I am planning to hold it for the next 10-20 years.
What are my ...
- 11
1
vote
1
answer
30
views
What is a good use case for .call functions' ability to pass a function call?
Following up on this thread, I wish to understand what will be a good use case using the feature to call a function in .call{}() ?
1
vote
0
answers
155
views
How to pass web3 client from server to client in next.js?
I spent all day (meh, not a record (but I'm not finished yet lol)) trying to pass the web3 instance to the client side of my app. Why would I use it on the server side? Well, to keep my wallet ...
- 69
1
vote
1
answer
113
views
What happens if 51% of validators in an epoch vote for an invalid block
Hypothesis
Full nodes that run both valid execution client and consensus-client would end up in a sort of deadlock and stop syncing. The consensus-client would try to feed the execution client with a ...
- 156
1
vote
0
answers
267
views
My Goerli wallet has been drained
I want to open this question from overflow since it was closed and I experience the same problem.
This account "0x87C02eeacB08c11aFBb821798DB2F4cCcd8F9E3d" has been stealing many goerli and ...
- 111
1
vote
1
answer
31
views
Whata are the differences between Ethereum and Ethereum Classic?
What are the key differences between Ethereum and Ethereum Classic and what implications do they have for the future of the Ethereum network?
- 139
1
vote
0
answers
42
views
Is a FIND_NODE ethereum packet encrypted
I was trying to inspect ethereum discovery protocol packets on my local machine using a private blockchain created using geth. I captured the packets using a tcpdump, and imported the pcap file into ...
- 11
1
vote
0
answers
49
views
What Smart Contract Code Analysis Tools Do You Use?
I've only recently (~6 months ago) picked up solidity as a coding language, but with the increase in hacks & importance of contract security community-wide, I feel the need to improve the current ...
- 11
1
vote
0
answers
922
views
Will the Legacy address on Ledger hardware wallets always be supported?
Ledger hardware wallets apparently have 2 different HD path types: Legacy and Ledger Live. Will the Legacy wallet addresses still be accessible and operational in new device models like the Ledger ...
- 1,558
1
vote
0
answers
582
views
ECDSA Nonce reuse attack
so I recently stumbled upon this video by @bertcmiller who created two transactions with the same nonce "k". That seen I researched quite a lot of pages explaining how to recover the private ...
- 21
1
vote
0
answers
55
views
Trying to solve the Solidity security challenge
I know how to get the address inside the list, but I don't understand how to make a signed message containing my name and the signature (from an address stored in winners.
Here is the code:
pragma ...
1
vote
1
answer
295
views
Is there a recommended maximum size for an input array in a Solidity smart contract?
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;
import "./interfaces/IERC20.sol";
contract Airdrop {
function airdropToken(
address _token,
address[] calldata ...
1
vote
0
answers
455
views
Protect Infura ID from being stolen and abused
I'm using an Infura API key for my dApp's "Connect Wallet" integration with Web3Modal
Key:
Relevant Codebase:
import Web3Modal from 'web3modal'
import WalletConnect from '@walletconnect/...
- 111
1
vote
0
answers
54
views
Are there any security concers with using @truffle/hdwallet-provider?
The project I am working on asked if I would remove the usage of @truffle/hdwallet-provider from our project due to security concerns. (One of the previous team members had supposedly concluded it isn'...
- 2,370
1
vote
0
answers
28
views
Solhint "Explicitly mark all external contracts as trusted" - how to fix
From my smart contract I am emitting an event defined in the interface (that my contract inherits/implements). I keep getting solhint warning about "Explicitly mark all external contracts as ...
- 11
1
vote
3
answers
104
views
Why sending ether from a smart contract is a security risk?
In this example from the Solidity documentation, inside the bid function, there is this comment:
Sending back the money by simply using highestBidder.send(highestBid) is a security risk because it ...
romin21
1
vote
0
answers
125
views
Secure Wallet Architecture Ideas
I have been tasked with developing a wallet that can store Cryptocurrency and NFTs. I understand that cryptos and nfts are not actually stored in the wallet, but the private keys that are used to ...
- 11
1
vote
0
answers
26
views
Transactions that led to the discovery of TheDAO hacker
What are the transactions that led to the discovery of the apparent hacker of TheDAO?
What are the primary transactions across the Ethereum, Bitcoin, and Grin blockchains?
eth♦
- 86.3k
1
vote
0
answers
48
views
How long can a Metamask password be?
How long can the Metamask password be, that encrypts my private key?
I would like to make it as long as possible.
- 133