Questions tagged [security]
Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.
182
questions with no upvoted or accepted answers
5
votes
0
answers
168
views
What are best practices for monitoring the OpenEthereum (Parity) logging?
Monitoring of the logging output of the Ethereum clients is essential for stable blockchain operation.
Do you have recommendations, experiences and/or lessons learned
concerning the logging of ...
- 448
4
votes
0
answers
152
views
Why does Ownable.sol from OpenZeppelin rely so much on the use of functions?
I wondered why OpenZeppelin relies so much on the use of functions when, at first glance, they seem unnecessary for such elementary operations. For example, take the Ownable.sol contract. Why isn't ...
- 51
4
votes
0
answers
523
views
What's reverted and not reverted during an Out of Gas exception?
A seemingly crucial question on EIP 158 was unanswered:
Unless the empty accounts are deleted even in the case of an EVM
exception, if that is the case would that not break the guarantee that
...
eth♦
- 85k
3
votes
0
answers
17
views
Ethereum sharding minimum committee size of 111 for safety
I am currently researching the minimum committee size required for Ethereum sharding. According to Vitalik, the minimum number of validators in a committee associated with a malicious committee ...
3
votes
0
answers
20
views
For anomaly detection on blockchain networks, what are some key differences between Ethereum and Bitcoin?
I'm currently exploring anomaly detection techniques on the Ethereum networks. From existing research papers available, I realized that anomaly detection research have been mostly done separately ...
- 43
3
votes
0
answers
167
views
How to store secure private keys on a server, that are being used for 'gasless' minting using EIP-712 based messages?
NOTE: By 'gasless' I mean that I won't have to mint the tokens for the user, they can mint it themselves provided they have a valid signature.
Hi,
In my NFT (ERC-721) contract, I'm allowing callers to ...
- 31
3
votes
0
answers
388
views
admin.peers shows peer info (local and public ip). Is this cause for concern?
I'm connecting to a private blockchain network over the internet using geth.
In the console of geth if you run admin.peers it lists both:
local_address(internal ip)
remote_address(external ip)
I have ...
3
votes
0
answers
769
views
Safe implementation on Solidity 0.8.0 of a withdrawal and a refund
I'm here for asking of a SECURE way to implement on solidity 0.8.0 two functions:
1-Withdrawal() which sends all the ether of the smart contract to the owner address. My current implementation is:
//...
3
votes
0
answers
1k
views
Frontrunning Uniswap horror story transactions
From the Ethereum is a Dark Forest post, the rescue plan was:
Deploy a Getter contract which, when called by its owner, would make
the burn call ONLY if activated, and otherwise revert.
Deploy a ...
eth♦
- 85k
3
votes
0
answers
106
views
Storing Private Keys in IoT Devices
In a network of IoT devices like internet-connected Raspberry Pis which sends transactions to the Ethereum blockchain, the Pis need to be able to access their own Ethereum private keys in order to ...
- 1,167
3
votes
0
answers
156
views
Parity create testing transactions and blocks
For test purposes, I would like to make test blocks including test transactions against main net.
For example I would like to make a transaction that sends one ether from 0x1234567... to 0x99999999......
- 4,635
3
votes
0
answers
1k
views
Is this approach to an ethereum lottery sound and/or novel?
I'm looking at making gambling apps is ethereum. Currently made a contract that can flip a coin. After looking at this question:
How can I securely generate a random number in my smart contract?
and ...
- 173
3
votes
0
answers
127
views
What is an empty account if the state root is not empty?
"State-bloat" attacks led to an empty account being defined as an account that has zero balance, nonce and code.
There was a disagreement on EIP 161:
I disagree. An account should be considered ...
eth♦
- 85k
2
votes
1
answer
14
views
Is it profitable for a miner to manipulate blocks in a small Ethereum project?
In the context of my blockchain project, I’m using the blockhash() function to generate randomness. However, I’m concerned about the potential vulnerability of this method. I’d like to know if, in a ...
- 21
2
votes
1
answer
71
views
How can ERC20 tokens be obtained in a local hardaht forked environment?
I've been learning about ethereum for a short time, besides my English could be better; if I'm wrong about something, please correct me. 😁 I am trying to test the interaction of different contract ...
- 21
2
votes
0
answers
30
views
Using veiw functions to overload Blockchain node
Question: What is stopping me from creating view function with heavy computation (infinite loop). Deploying it on Blockchain and then calling it just so I could overload a Blockchain node that ...
- 2,204
2
votes
1
answer
104
views
Does a Rollup transaction need the parameter 'nonce'?
Recently I am learning Rollups, and one thing makes me confused is that, Does the compressed transaction in a batch need the parameter nonce?
Here in on-chain-scaling-to-potentially-500-tx-sec-through-...
2
votes
0
answers
88
views
SWC-126 Insuffixient Gas Griefing attack: why not simply requiring a successfull sub-call?
I'm trying to learn more about the SWC Smart Contract Weakness Classification and Test Cases. I'm stuck on understanding SWC-126: https://swcregistry.io/docs/SWC-126. Especially, I don't understand ...
- 121
2
votes
0
answers
124
views
Even if I own 51% of stake (or have 51% computational power) and try to cheat, can't others still see that my block is invalid?
I'm thinking about how proof of stake works exactly.
As I understand, here is how it is secure:
I cannot forge a tx where random A pays me X amount because I would need the private keys of A. ...
- 121
2
votes
0
answers
31
views
Is there any free-to-use scenario builder?
The Compound Protocol has a collection of high-level integration tests, dubbed "scenarios":
https://github.com/compound-finance/compound-protocol/tree/v2.8.1/spec
Which look like this:
Test &...
- 17.3k
2
votes
0
answers
299
views
How does MetaMask secure / store unlocked accounts?
I understand that MetaMask stores the encrypted vault somewhere like
C:\Users\USER_NAME\AppData\Local\Google\Chrome\User Data\Default\Local
Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
...
- 691
2
votes
2
answers
358
views
How does this function potentially violates the Checks-Effects-Interaction pattern?
I am developing a smart contract that integrates with the DAI stable coin. In the function below, you can see that I have followed the check effects interaction pattern, so how come I still get a ...
2
votes
3
answers
439
views
Proxy function clashing - what kind of danger comes exactly with it?
I read that if I am using proxy, there is a chance of function clashing. Let's say in my contract there is a function with a signature:
proxyOwner()
...
- 761
2
votes
1
answer
174
views
In the case the Zerofunctionselector bug, how to know which function NAME has a 0 selector?
Normally, If a smart contract is not affected by the Zerofunctionselector bug, then at the end of the code which makes jump to the target function lies a 0xfe opcode (which result in the smart ...
- 961
2
votes
0
answers
80
views
What would be the steps required to entirely derive an address with pen and paper?
I'd like to see the steps required to derive an address by hand, with pen and paper, along with an estimate of time required.
Is it feasible to derive an address entirely with pen and paper?
What ...
- 8,468
2
votes
0
answers
215
views
Why does the new light-client example throw a warning?
Even though I use the new example, lightwallet throws me:
The new KeyStore constructor has been deprecated in favor of KeyStore.createVault(), and will be removed in a future version. Read issue #...
- 11.6k
2
votes
0
answers
149
views
How many people were involved in auditing the DAO code? And how many Eth code auditors are there we can goto?
How many were responsible for auditing the DAO code? It's understandable that bugs arise from any type of code, but having that the DAO was a big project and that once its created it shouldn't be ...
- 4,800
1
vote
0
answers
38
views
Creating a sufficiently random number via computation entropy without an oracle
I am creating a token that requires a sufficiently random number for an internal lottery.
uint randomX;
function semirandomize(uint prevRandom, uint time) private view returns (uint) {
...
- 79
1
vote
0
answers
33
views
How to run a script which requires a private key completely in a browser?
For a non-technical person I need to create a page on my website, in the admin area, in which he'd regularly do stuff that normally is done on local machine only. That is, a person doesn't want to go ...
- 49
1
vote
0
answers
44
views
How to prevent replay attacks on ZK Proof Transactions?
Alice wants to prove a statement (let's say, she has a secret value x such that x * 2 = 10) to Bob without revealing x).
Alice generates a proof using the ZK-Snark protocol.
const { proof, ...
- 296
1
vote
2
answers
34
views
Ways to earn ETH passive income
I have a decent amount of ETH in my cold wallet (<32 ETH). These bag of ETH is my HODL bag, meaning that I don't want to spend it and I am planning to hold it for the next 10-20 years.
What are my ...
- 11
1
vote
1
answer
26
views
What is a good use case for .call functions' ability to pass a function call?
Following up on this thread, I wish to understand what will be a good use case using the feature to call a function in .call{}() ?
1
vote
1
answer
314
views
Fake BUSD transcation sent from my wallet (not fake 0 token scam)!
Transaction Hash: 0x7800fb4d9345fc7e8b2794a479f414948eb1a9126e14daff11d1802440996a68
The hackers sent fake busd token (with >0 amount) from multiple victims wallet to another wallet without any ...
- 11
1
vote
0
answers
107
views
How to pass web3 client from server to client in next.js?
I spent all day (meh, not a record (but I'm not finished yet lol)) trying to pass the web3 instance to the client side of my app. Why would I use it on the server side? Well, to keep my wallet ...
- 59
1
vote
1
answer
67
views
What happens if 51% of validators in an epoch vote for an invalid block
Hypothesis
Full nodes that run both valid execution client and consensus-client would end up in a sort of deadlock and stop syncing. The consensus-client would try to feed the execution client with a ...
- 156
1
vote
0
answers
236
views
My Goerli wallet has been drained
I want to open this question from overflow since it was closed and I experience the same problem.
This account "0x87C02eeacB08c11aFBb821798DB2F4cCcd8F9E3d" has been stealing many goerli and ...
- 11
1
vote
1
answer
27
views
Whata are the differences between Ethereum and Ethereum Classic?
What are the key differences between Ethereum and Ethereum Classic and what implications do they have for the future of the Ethereum network?
- 139
1
vote
0
answers
26
views
Is a FIND_NODE ethereum packet encrypted
I was trying to inspect ethereum discovery protocol packets on my local machine using a private blockchain created using geth. I captured the packets using a tcpdump, and imported the pcap file into ...
- 11
1
vote
0
answers
46
views
What Smart Contract Code Analysis Tools Do You Use?
I've only recently (~6 months ago) picked up solidity as a coding language, but with the increase in hacks & importance of contract security community-wide, I feel the need to improve the current ...
- 11
1
vote
0
answers
463
views
ECDSA Nonce reuse attack
so I recently stumbled upon this video by @bertcmiller who created two transactions with the same nonce "k". That seen I researched quite a lot of pages explaining how to recover the private ...
- 21
1
vote
0
answers
53
views
Trying to solve the Solidity security challenge
I know how to get the address inside the list, but I don't understand how to make a signed message containing my name and the signature (from an address stored in winners.
Here is the code:
pragma ...
1
vote
0
answers
386
views
Protect Infura ID from being stolen and abused
I'm using an Infura API key for my dApp's "Connect Wallet" integration with Web3Modal
Key:
Relevant Codebase:
import Web3Modal from 'web3modal'
import WalletConnect from '@walletconnect/...
- 111
1
vote
0
answers
40
views
Are there any security concers with using @truffle/hdwallet-provider?
The project I am working on asked if I would remove the usage of @truffle/hdwallet-provider from our project due to security concerns. (One of the previous team members had supposedly concluded it isn'...
- 2,204
1
vote
0
answers
28
views
Solhint "Explicitly mark all external contracts as trusted" - how to fix
From my smart contract I am emitting an event defined in the interface (that my contract inherits/implements). I keep getting solhint warning about "Explicitly mark all external contracts as ...
- 11
1
vote
3
answers
97
views
Why sending ether from a smart contract is a security risk?
In this example from the Solidity documentation, inside the bid function, there is this comment:
Sending back the money by simply using highestBidder.send(highestBid) is a security risk because it ...
romin21
1
vote
0
answers
118
views
Secure Wallet Architecture Ideas
I have been tasked with developing a wallet that can store Cryptocurrency and NFTs. I understand that cryptos and nfts are not actually stored in the wallet, but the private keys that are used to ...
- 11
1
vote
0
answers
26
views
Transactions that led to the discovery of TheDAO hacker
What are the transactions that led to the discovery of the apparent hacker of TheDAO?
What are the primary transactions across the Ethereum, Bitcoin, and Grin blockchains?
eth♦
- 85k
1
vote
0
answers
44
views
How long can a Metamask password be?
How long can the Metamask password be, that encrypts my private key?
I would like to make it as long as possible.
- 133
1
vote
0
answers
33
views
Security for play-to-earn action game
So I'm making a play-to-earn game, that is a web game and its logic runs on the user's machine. After the player finishes a session, the game will call the following mint function:
contract GoldCoin ...
1
vote
2
answers
128
views
How to do the payment of royalties for a NFT marketplace transaction?
I have read the EIP-2891, but I don't know what is the correct way to approach the payment when the transaction occurs.
Initially I thought of doing something like this:
(...)
// Transfer ...
- 11