Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
1
vote
2answers
86 views

Automatically test who can withdraw Ether from a smart contract

Is there any way I can automatically test who can withdraw ether from a smart contract? I need to perform this test automatically. So I cannot manually inspect the instructions. Can I design a smart ...
0
votes
2answers
25 views

Sending extra data beside or inside a new smart contract

I'm doing a research about Ethereum smart contracts security and I need to send some extra data (for example some json data) beside or inside a new smart contract when I'm deploying that contract on ...
0
votes
1answer
21 views

Changing transaction validation process in Ethereum

I am doing a research about Ethereum smart contracts security. For this purpose I want to make some changes in Ethereum miner and transactions validation process (editing miner for automatically ...
166
votes
20answers
47k views

How can I securely generate a random number in my smart contract?

If I am writing a smart contract for some kind of (gambling) game, how can I generate a random number securely? What are the best practises and security trade-offs to be aware of?
0
votes
2answers
211 views

Web wallet best practices

I'm putting together an ether/erc20 token wallet in a chrome extension but would like to follow best practices with regards to private key security. I'm using localstorage to handle login and its ...
1
vote
1answer
29 views

Is a Hash Function really useful in a Smart Contract Election?

Noob here. Was reading this: https://karl.tech/learning-solidity-part-2-voting/ From my basic understanding, a hash function: Receives an input (like x) and spits some result (like y) y is ...
0
votes
1answer
18 views

It is secure do accounts just with web3.eth.accounts.create() ? (entropy)

const Web3 = require('web3'); let url = 'infuralink'; let web3 = new Web3(url); console.log(web3.eth.accounts.create()); This is the code of many tutorials for do a key pair. it is completely secure ...
0
votes
0answers
16 views

How does MetaMask secure / store unlocked accounts?

I understand that MetaMask stores the encrypted vault somewhere like C:\Users\USER_NAME\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn ...
0
votes
1answer
126 views

Security Implications of allowing remote RPC connections to Geth Node

What are the security Implications of allowing remote RPC connections to Geth Node? If one absolutely needs to allow remote rpc connections for web3 connection, how can one do this while securing the ...
0
votes
0answers
15 views

How do I store or use private keys in node js that I deploy in live server?

I have a live server running a full GETH NODE in which I need to sign a transaction with a private key. The problem is I dont know how I can use the private key without explicitly providing the ...
2
votes
1answer
31 views

Is the May 2017 contract creation attack still possible?

In May 2017, an "attacker" created a contract that attempts to create many other contracts(using many JUMPDEST operations in the creation bytecode) until it runs out of gas. I see the gas ...
1
vote
1answer
33 views

Risk of Messages Not Having a Signature

As per my understanding transactions are signed before sending to Ethereum. Else, no transfer of Ether will happen. However, messages sent to Smart Contracts (SC) aren't signed (e.g., using methods....
0
votes
1answer
42 views

Sharing an verifiable secret message in a contract

I would like to hear your opinion on my idea to share a proof of a secret message in a contract, that users can verify later in a second phase when the message will be revealed. If the message is a ...
0
votes
1answer
41 views

Gas optimisation for my art experiment spacecans.com

so I was microdosing some research chems and the thought came to me that I need to do some artsy blockchain stuff for once. It's two tin cans floating in space that you can advertise your so-called ...
1
vote
1answer
215 views

Using Hardware Security Modules to generate and store private keys on private ethereum / quorum

For a private ethereum networks, has anyone used Hardware Security Modules (HSM) to generate and store Ethereum private keys? I am keen to know how public/private keys are managed without a PKI (...
0
votes
1answer
22 views

Should Try-Catch error handling be avoided for security? [closed]

What implications can it have to the security of a function if the content of it is wrapped into try-catch statements?
48
votes
4answers
36k views

<address>.send vs <address>.transfer best practice usage?

I noticed that address's offer two member functions that perform the transfer of ether to the specified address. send returns false upon failure and transfer raises an exception. In the Solidity ...
1
vote
1answer
47 views

How does this function potentially violates the Checks-Effects-Interaction pattern?

I am developing a smart contract that integrates with the DAI stable coin. In the function below, you can see that I have followed the check effects interaction pattern, so how come I still get a ...
1
vote
1answer
23 views

State only node

Is it possible for the network clients to just keep the latest network state (without keeping track of the past transactions) while not harming the network security? That is, is it really needed to ...
1
vote
1answer
177 views

Implication of hacking into an ethereum node on proof of stake

It is my understanding that in proof of stake, the validator puts up a stake that gets slashed if they don't respond to requests truthfully. In the scenario that someone hacks into your node, wouldn't ...
2
votes
1answer
73 views

The blockchain trilemma

I understand that the generic blockchain faces a problem where it can choose to optimize between scalability, security and decentralization. I can see easily why scalability and decentralization are ...
1
vote
1answer
200 views

Hidding IP address behind sentry nodes

I would like to know how to set up an Ethereum node behind sentries (proxy nodes). I know there are several ways to approach this issue as mentioned here. https://medium.com/@kidinamoto/tech-choices-...
2
votes
1answer
59 views

In the case the Zerofunctionselector bug, how to know which function NAME has a 0 selector?

Normally, If a smart contract is not affected by the Zerofunctionselector bug, then at the end of the code which makes jump to the target function lies a 0xfe opcode (which result in the smart ...
0
votes
1answer
141 views

Are there any security issues to send token in fallback function?

I want to have a contract that releases an erc-20 token as soon as someone pays ether to contract. Let's call this contract Bid Contract. The abstract code goes like: function askForTokens() public ...
0
votes
1answer
284 views

Threat Model Question - Code Injection / ROP possible in Ethereum Smart Contracts?

I am trying to understand a basic threat model for Ethereum Smart Contracts, to perform some research on how existing attacks techniques may be applied here as well. Is there a risk of a contract with ...
0
votes
1answer
329 views

How can I change the 12 word phrase in my trust wallet?

I created a ETH trust wallet on my phone for someone and he has now imported the trust wallet to his phone. Is there any way to change the 12 word phrase or somehow give the sole control to the ...
0
votes
1answer
208 views

transfer/send error cases

I have a (noob) question on the usage of transfer and send. I have seen that transfer is equivalent to require(x.send(k)); When I use send() I know that I have to check whether there was an error ...
52
votes
3answers
13k views

Why can't contracts make API calls?

The model that contracts can only accept and process data, instead of also being able to retrieve data from the Internet, seems limiting (even if not, it's less direct). If a concern is that data or ...
1
vote
1answer
46 views

Who is 0x093a0ed738b65ed34f2a37a2d44c5e3cd0d0dd45?

I was working with ethereum using: - solcjs web3 truffle public no firewall kovan node (parity) and MultiSigWallet.sol from https://github.com/gnosis/MultiSigWallet And when I checked my wallet in ...
0
votes
1answer
50 views

Front-running in Quorum IBFT

Are pending transactions processed sequentially in IBFT? In a networks based on PoW you would usually pay higher gas price in order to get your transaction mined first. Is there a way to manipulate ...
4
votes
1answer
126 views

Underhanded Solidity: Exploiting multiple inheritance

In an article by Steve Marx (on Medium.com), the author argues against using inheritance in solidity not only because of harder readability of a Smart Contract, but also because it can be exploited in ...
0
votes
0answers
10 views

Why can only operators transfer between partitions (ERC1400)?

I came across this line in the ERC1400 implementation (by polymath I believe). if (operatorData.length != 0 && data.length >= 64) { toPartition = _getDestinationPartition(fromPartition,...
1
vote
2answers
460 views

Automatic transaction

I would like to know if it was possible to automatically send any ETH amout to an address "B" just after receiving them on an address "A"? Maybe via a script? I need help
1
vote
2answers
52 views

Dos with revert

While I was reading a guide on smart contract security (by consensys) I found this: // INSECURE contract Auction { address currentLeader; uint highestBid; function bid() payable { ...
1
vote
1answer
24 views

Scam: Sent ETH to HEX Contract - Where is it?

I sent ETH to the HEX contract, waited for 24 hours to transform and was ready to click "exit" at the end but it just disappeared?
3
votes
1answer
395 views

How does PassHasBeenSet honeypot contract work?

I've been trying to pick this honeypot contract apart, but I haven't figured out exactly how it works. overview The premise is pretty simple, the contract is set up to look like a "new year's gift" ...
1
vote
1answer
34 views

Can't people be tricked into calling approve on an ERC token contract, and having their tokens stolen?

Most users of Ethereum and ERC tokens probably aren't aware of the existence of the approve and transferFrom functions. Couldn't users unknowingly call approve on an ERC token contract, and ...
0
votes
1answer
39 views

Security flaws in a simple smart contract

I developed a simple smart contract to store two privacy preferences for a user. I am testing and evaluating this contract on a private blockchain via Ganache. I am currently validating the security ...
0
votes
1answer
16 views

Is there any other signature mechanism like ECDSA to verify the signed message if its tampered or not?

I would like to know if there are other signature verification methods other than ECDSA, to verify the message (eg., string, number) signed by a signer. Actually if there are alternative algorithms ...
20
votes
2answers
3k views

Security review checklist for a smart contract

Is there a tool, checklist of methodology to help reviewing smart contract security? E.g. for each of function you review Is there re-entry possibility and how it behaves on re-entry How it behaves ...
1
vote
1answer
21 views

Is it possible for an interaction between two contracts be interfered with by another contract?

For example: 1.Contract A makes a call to contract B to retrieve a state value from B 2.Contract A then uses the data provided by contract B to create modified value 3.Contract A sends the derived ...
0
votes
1answer
42 views

Does reentrancy attack happens as soon as the balance in storage is modified after the withdrawal?

I just saw something like this: function sub( uint a, uint b ) internal pure returns (uint) { require(b <= a, "SUB_UNDERFLOW"); return a - b; } function withdraw(...
1
vote
1answer
54 views

adaptive vs. non-adaptive adversaries? Is there a precise, unique and general definition? (Updated)

In this Ethereum github page (Link to the page: https://github.com/ethereum/wiki/wiki/Sharding-FAQ#what-are-the-security-models-that-we-are-operating-under) there is a very brief definition of the ...
1
vote
1answer
69 views

Access manager in Smart Contract

I'm building a service where one can publish a crypted file on the internet which can be accessed and decrypted by people allowed. I don't want to store any crypted key on a server or something. For ...
0
votes
1answer
43 views

ERC20 vulnerability? Executing transferFrom undesirably

Say I have a contract called MyContract, and I require to send 100000 DAI to it. Ideally, I'd firstly call approve(<address of A>, 100000e18) in DAI's contract itself. Secondly, I'd execute, for ...
1
vote
0answers
48 views

How dangerous the 'short address' attack is as of 2019, October and what ways there are to mitigate it? [duplicate]

From what I read there's a well public knowledge of reantrancy and underflows/overflows due to the cases of documented hacks and stolen ether - yet the short address attack seems less known. I know in ...
56
votes
6answers
78k views

What number of confirmations is considered secure in Ethereum?

In Bitcoin, 6 confirmations are considered secure (very low probability of transaction/block reversal). What is the current number in Ethereum?
0
votes
3answers
39 views

How to prevent someone running a transaction before me?

Let's say I have the following in my smart contract: string passwordHash; uint money; function checkPassword(string cleanPassword, string newPasswordHash)[...] When running the function ...
0
votes
1answer
462 views

Setting up MyEtherWallet on iOS device from Coinbase

Can I securely set up and store a MyEthereumWallet on iOS only without an computer? I want to transfer ethers from Coinbase.
0
votes
2answers
59 views

Is there a way to create double-spending transactions and submit them to different nodes?

I'm trying to create two transactions with the same nonce and send those transactions to two different nodes. Such as: const Web3 = require('web3'); const web3_1 = new Web3(rpcURL1); // node 1 const ...

1
2 3 4 5
11