Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
0
votes
1answer
457 views

Setting up MyEtherWallet on iOS device from Coinbase

Can I securely set up and store a MyEthereumWallet on iOS only without an computer? I want to transfer ethers from Coinbase.
0
votes
2answers
41 views

Is there a way to create double-spending transactions and submit them to different nodes?

I'm trying to create two transactions with the same nonce and send those transactions to two different nodes. Such as: const Web3 = require('web3'); const web3_1 = new Web3(rpcURL1); // node 1 const ...
0
votes
1answer
36 views

Leverage short positions in decentralised PoW currencies

Hint I asked this question in a similar style already on bitcointalk and on bitcoin.stackexchange. But in these threads, there are no good answers and I thought maybe it would be better to ask the ...
0
votes
1answer
41 views

How to build security into Dapps?

I am building a loan dapp. The functionality is not easy to build but relatively straightforward. My question is though does anyone have any suggestions of how to build in user logins and security? ...
0
votes
0answers
29 views

Who is 0x093a0ed738b65ed34f2a37a2d44c5e3cd0d0dd45?

I was working with ethereum using: - solcjs web3 truffle public no firewall kovan node (parity) and MultiSigWallet.sol from https://github.com/gnosis/MultiSigWallet And when I checked my wallet in ...
2
votes
1answer
54 views

In the case the Zerofunctionselector bug, how to know which function NAME as a 0 selector?

Normally, If a smart contract is not affected by the Zerofunctionselector bug, then at the end of the code which makes jump to the target function lies a 0xfe opcode (which result in the smart ...
14
votes
3answers
6k views

How to validate a private key?

I could not find any library that, given an hex value, returns true if the given string is a valid ether private key. Any hints?
0
votes
2answers
707 views

Division/Percentages in Solidity (a workaround)

Division/percentages is a required part of many applications but is difficult to implement since fixed and ufixed are not supported yet in Solidity. I've come up with this workaround: pragma ...
0
votes
0answers
10 views

Drizzle Dapp on HTTP vs. HTTPS

If I have a Drizzle dap on an http server. Is there a risk that the private keys used with this dapp can be revealed? I suppose this is like asking if a MetaMask interaction within the unsecure http ...
2
votes
0answers
20 views

Protocol for Response to Ethereum Account Hack [closed]

Last week a single Ethereum account in my wallet was hacked. When I send ETH to it, within 2 blocks the hacker-bot uses my private key and sends 0.0009 ETH to another account and then maxes out the ...
1
vote
3answers
46 views

Is it possible to deploy a contract on the same address after self-destruct?

As far as I understand self-destruct simply deletes the code from a contract and turns it into a regular wallet + it sends all funds to caller/argument. But is there a way to recreate the contract? I ...
1
vote
0answers
28 views

Sending secure transactions using web3.py

An ethereum account I had has been hacked, where whenever I send it, say, 0.1 eth, some evil bot immediately sends 0.0009 eth from that account to a dummy account, and then spends the remaining 0.0991 ...
0
votes
1answer
72 views

User anonymity while submitting data in smart contract

I've written a smart contract, that is a crowd sensing system. Where post posting a task user view that task and if they have what I'm asking for/and meet the task requirements they submit certain ...
0
votes
1answer
62 views

Proxy function clashing - what kind of danger comes exactly with it?

I read that if I am using proxy, there is a chance of function clashing. Let's say in my contract there is a function with a signature: proxyOwner() ...
0
votes
1answer
75 views

Automatically test who can withdraw Ether from a smart contract

Is there any way I can automatically test who can withdraw ether from a smart contract? I need to perform this test automatically. So I cannot manually inspect the instructions. Can I design a smart ...
0
votes
0answers
37 views

Can ETH be hacked by inserting a forwarding contract?

Just to be clear I am not going to name any companies in this post since there is still an investigation going on as to how this happened. As you can guess by the question ETH has been stolen from me,...
0
votes
1answer
113 views

Quorum Consensus - BAR (Byzantine Altruistic Rational) Fault Tolerance / BAR Fault Tolerance / BAR Model

I refer to http://www.cs.utexas.edu/~dahlin/projects/bft/ http://www.cs.cornell.edu/lorenzo/papers/sosp05.pdf http://www.cs.northwestern.edu/~fabianb/classes/cs-443-w07/BAR.pdf https://blog.ethereum....
1
vote
1answer
27 views

Risk of Messages Not Having a Signature

As per my understanding transactions are signed before sending to Ethereum. Else, no transfer of Ether will happen. However, messages sent to Smart Contracts (SC) aren't signed (e.g., using methods....
0
votes
1answer
115 views

Security Implications of allowing remote RPC connections to Geth Node

What are the security Implications of allowing remote RPC connections to Geth Node? If one absolutely needs to allow remote rpc connections for web3 connection, how can one do this while securing the ...
0
votes
1answer
16 views

Calling transferFrom of external erc20 contract

Hey I'm calling externals contract method transferFrom in following way. function sendTransaction(address tokenAddress, uint tokenAmount) public payable { if (!performTransfer(tokenAddress, ...
52
votes
7answers
7k views

How can I verify that a contract on the blockchain matches the source code?

Given the (Solidity) source code of a smart contract, is there a way to deterministically compile the code and compare it with the code on the blockchain? I want to verify that the contract does what ...
0
votes
1answer
34 views

Gas optimisation for my art experiment spacecans.com

so I was microdosing some research chems and the thought came to me that I need to do some artsy blockchain stuff for once. It's two tin cans floating in space that you can advertise your so-called ...
0
votes
1answer
25 views

Lottery Winning number based on blockhash

After reading a lot of Info about this topic in this forum I am asking whether I can just use the formular winningNumber = uint256(blockhash(block.number-1)) % 100; e.g. 10 or 20 blocks after the ...
1
vote
1answer
17 views

Information Regarding LASER and Ethereum

I was reading this article https://diligence.consensys.net/files/D1T2%20-%20Bernhard%20Mueller%20-%20Smashing%20Ethereum%20Smart%20Contracts%20for%20Fun%20and%20ACTUAL%20Profit.pdf and came across ...
1
vote
1answer
204 views

Using Hardware Security Modules to generate and store private keys on private ethereum / quorum

For a private ethereum networks, has anyone used Hardware Security Modules (HSM) to generate and store Ethereum private keys? I am keen to know how public/private keys are managed without a PKI (...
0
votes
1answer
34 views

Sharing an verifiable secret message in a contract

I would like to hear your opinion on my idea to share a proof of a secret message in a contract, that users can verify later in a second phase when the message will be revealed. If the message is a ...
1
vote
1answer
33 views

Difference between MythX and Mythril for security auditing

I know that both mythrix and mythril are used for smart contracts auditing but I didn't figure out yet the difference between them. I'll appreciate any help.
1
vote
1answer
173 views

Implication of hacking into an ethereum node on proof of stake

It is my understanding that in proof of stake, the validator puts up a stake that gets slashed if they don't respond to requests truthfully. In the scenario that someone hacks into your node, wouldn't ...
1
vote
1answer
36 views

How does this function potentially violates the Checks-Effects-Interaction pattern?

I am developing a smart contract that integrates with the DAI stable coin. In the function below, you can see that I have followed the check effects interaction pattern, so how come I still get a ...
0
votes
1answer
137 views

Are there any security issues to send token in fallback function?

I want to have a contract that releases an erc-20 token as soon as someone pays ether to contract. Let's call this contract Bid Contract. The abstract code goes like: function askForTokens() public ...
0
votes
1answer
273 views

Threat Model Question - Code Injection / ROP possible in Ethereum Smart Contracts?

I am trying to understand a basic threat model for Ethereum Smart Contracts, to perform some research on how existing attacks techniques may be applied here as well. Is there a risk of a contract with ...
0
votes
0answers
35 views

what is wrong with this token contract?

This one: https://etherscan.io/address/0xc12d1c73ee7dc3615ba4e37e4abfdbddfa38907e As you can see most of the last transfer fail, the transfer function is: function transfer(address recipient, ...
0
votes
1answer
201 views

transfer/send error cases

I have a (noob) question on the usage of transfer and send. I have seen that transfer is equivalent to require(x.send(k)); When I use send() I know that I have to check whether there was an error ...
0
votes
0answers
21 views

Security implications on limiting the round change timeout of Istanbul BFT consensus algorithm?

I have a security-related question regarding the exponentially increasing timeout in the round change, which is used in the Istanbul Byzantine fault-tolerance consensus algorithm used by Quorum. ...
0
votes
1answer
191 views

Web wallet best practices

I'm putting together an ether/erc20 token wallet in a chrome extension but would like to follow best practices with regards to private key security. I'm using localstorage to handle login and its ...
0
votes
0answers
20 views

How to trace transactions to get information about hot and cold wallets?

I am researching ways how to trace transactions to get data about hot and cold wallets of exchanges, gambling sites, cantors, mixers. What sources of data could I use? What algorithms and scripts ...
5
votes
1answer
599 views

Is transfer() still safe after the Istanbul update?

In other words, is using transfer() safe? function transfer(address contractB) public { contractB.transfer(1000); //balances[msg.sender] -= 1000; } How about using call.gas? function ...
1
vote
1answer
890 views

ETH stolen from two MEW wallets & moved to an unknown address & then to ShapeShift

I recently found out that my ETH funds were stolen from two MEW wallets and moved to an unknown address. Below are addresses of my two MEW wallets. 1) 0x16bf750Ee569F0A173BCCfD7b3F92F9Bb46c6AfC (...
9
votes
4answers
3k views

Geth RPC connections securely

I have read everywhere that exposing personal over rpc is dangerous and is vulnerable. The question is HOW? Is it possible for anyone to send transactions to my geth console, if my ipaddress and port ...
48
votes
3answers
34k views

<address>.send vs <address>.transfer best practice usage?

I noticed that address's offer two member functions that perform the transfer of ether to the specified address. send returns false upon failure and transfer raises an exception. In the Solidity ...
1
vote
2answers
424 views

Automatic transaction

I would like to know if it was possible to automatically send any ETH amout to an address "B" just after receiving them on an address "A"? Maybe via a script? I need help
1
vote
2answers
28 views

How can I find out the sender's gas limit?

Is there a way to check Sender's Gas Limit? If the sender sets too low, I will just accept whatever gas amount that he had set and return immediately without hitting the limit. I am trying to ...
1
vote
2answers
41 views

Is it possible to circumvent a require statement if the ordering of the requirements are incorrect?

Please take the following hypothetical code as an example mapping (address => uint256) public accountBalance; function deposit(uint256 amount) public { accountBalance[msg.sender] = ...
1
vote
2answers
39 views

Dos with revert

While I was reading a guide on smart contract security (by consensys) I found this: // INSECURE contract Auction { address currentLeader; uint highestBid; function bid() payable { ...
0
votes
2answers
53 views

How to fight against a cheating node?

As far as I know, there are roughly two kinds of contract calls on Ethereum. One kind is intended to change the global state of blockchain (i.e. change some storage values or transfer money). The ...
1
vote
1answer
45 views

Is it safe to do multiple payments in between locks (Reentrancy Guard)?

https://diligence.consensys.net/blog/2019/09/stop-using-soliditys-transfer-now/ provides a simple example related to using a Reentrancy Guard. Another approach to preventing reentrancy is to ...
3
votes
1answer
391 views

What's the vulnerability in my contract?

I've got a contract deployed at 0xe559835D7979dAe994331DEfaEc2FBA057E56C27 on the mainnet. Every time I go to call the payable function, which is solve, a bot beats me to it. My transaction gets ...
1
vote
1answer
31 views

private key vs seed

I made an extra account in Metamask for my GF, I kept Account 1 for myself and I gave only the private key of Account 2 to my GF. I kept the seed words only to myself. Since then, she has dumped me ...
0
votes
2answers
2k views

Is it possible to regenerate my seed phrase if I have my private key?

The thing is I lost my seed phrase for MetaMask wallet. Luckily I had also backed up my private key. Is it possible to regenerate my "seed phrase" from my private key? It would be great if I could do ...
1
vote
1answer
24 views

Is it considered secure at all to use passwords and private keys in the code of smart contract?

Basically something like: function transfer(address to, string privkey) { if(privkey == "cd33434343...") { msg.sender.transfer(this.balance); } } The above is obviously flawed since the privkey is ...

1
2 3 4 5
11