Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
168
votes
20answers
48k views

How can I securely generate a random number in my smart contract?

If I am writing a smart contract for some kind of (gambling) game, how can I generate a random number securely? What are the best practises and security trade-offs to be aware of?
0
votes
1answer
35 views

How do I test the Ethereum Blockchain app [closed]

I have created an Ethereum blockchain application that stores data on the blockchain network. I want to test the application from a SQL injection attack using SQLMap tool. The SQLMap tool, when ...
0
votes
0answers
13 views

_transferFrom vs. _burnFrom order of operations (Zeppelin ERC20burnable.sol)

I have question, more for my understanding than anything. Here’s the transferFrom function in the ERC20 standard: function transferFrom(address sender, address recipient, uint256 amount) public ...
1
vote
3answers
48 views

How to prevent frontrunning: someone running a transaction before me?

Let's say I have the following in my smart contract: string passwordHash; uint money; function checkPassword(string cleanPassword, string newPasswordHash)[...] When running the function ...
27
votes
1answer
4k views

When can BLOCKHASH be safely used for a random number? When would it be unsafe?

I've seen more complicated ways for a contract to generate a random number. But the Ethereum Yellow Paper itself suggests a "trivial solution" using the BLOCKHASH opcode (see below, bold is mine). ...
0
votes
0answers
31 views

Proof-of-Stake: How to prevent someone from being always selected as an author of block? [duplicate]

In proof-of-stake, by definition, each stakeholder deposits and locks some tokens (stakes) for more chances to be selected as an author of block in a random-based election procedure. Till here, it's ...
2
votes
1answer
39 views

Is there a way to verify transactions afterwards they are entered in the ethereum blockchain?

Suppose I sent a signed transaction using the web3.js library. But, I might be using some third party API like an Infura node or others. So there are chances of attacks and data manipulation. So, is ...
1
vote
2answers
507 views

Automatic transaction

I would like to know if it was possible to automatically send any ETH amout to an address "B" just after receiving them on an address "A"? Maybe via a script? I need help
1
vote
2answers
55 views

Dos with revert

While I was reading a guide on smart contract security (by consensys) I found this: // INSECURE contract Auction { address currentLeader; uint highestBid; function bid() payable { ...
0
votes
1answer
22 views

How is transferFrom secure?

function transferFrom(address sender, address recipient, uint256 amount) public virtual override returns (bool) { _transfer(sender, recipient, amount); _approve(sender, _msgSender(), ...
0
votes
1answer
13 views

Token Restrictions Helping me Understand Blockchain Logic

To execute the transfer or transferFrom ERC-20 token functions in a Solidity contract, ie: // moves token from contract to personal address ERC20Token.transfer(msg.sender, tokenamount); // ...
1
vote
1answer
71 views

Access manager in Smart Contract

I'm building a service where one can publish a crypted file on the internet which can be accessed and decrypted by people allowed. I don't want to store any crypted key on a server or something. For ...
1
vote
1answer
8 views

If you're a node, why would you accept other node's solution instead of copying and broadcasting that solution?

Let's say someone broadcasted a solution to the recent block. Why, as a node, would I accept it? I can just copy and broadcast it myself instead. Yes, most of the times the first node would win, but ...
19
votes
3answers
3k views

How do gas refunds work?

Gas refunds are provided when clearing storage or calling SELFDESTRUCT on contracts. The Yellow Paper mentions that refunds are "being capped up to a maximum of half...". What exactly is ...
2
votes
0answers
112 views

Frontrunning Uniswap horror story transactions

From the Ethereum is a Dark Forest post, the rescue plan was: Deploy a Getter contract which, when called by its owner, would make the burn call ONLY if activated, and otherwise revert. Deploy a ...
0
votes
0answers
17 views

Avoiding contract impersonation

Newbie question. Suppose I have contract X which have a foo function which accepts contract of type Y and calls function bar on it like this. contract Y { function bar() public; } contract X { ...
0
votes
1answer
53 views

ERC20 vulnerability? Executing transferFrom undesirably

Say I have a contract called MyContract, and I require to send 100000 DAI to it. Ideally, I'd firstly call approve(<address of A>, 100000e18) in DAI's contract itself. Secondly, I'd execute, for ...
1
vote
1answer
57 views

adaptive vs. non-adaptive adversaries? Is there a precise, unique and general definition? (Updated)

In this Ethereum github page (Link to the page: https://github.com/ethereum/wiki/wiki/Sharding-FAQ#what-are-the-security-models-that-we-are-operating-under) there is a very brief definition of the ...
1
vote
0answers
17 views

Is there any free-to-use scenario builder?

The Compound Protocol has a collection of high-level integration tests, dubbed "scenarios": https://github.com/compound-finance/compound-protocol/tree/v2.8.1/spec Which look like this: Test &...
0
votes
2answers
1k views

How can I change the 12 word phrase in my trust wallet?

I created a ETH trust wallet on my phone for someone and he has now imported the trust wallet to his phone. Is there any way to change the 12 word phrase or somehow give the sole control to the ...
1
vote
0answers
45 views

How does MetaMask secure / store unlocked accounts?

I understand that MetaMask stores the encrypted vault somewhere like C:\Users\USER_NAME\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn ...
4
votes
1answer
138 views

What is the “pre-commit” scheme to defeat frontrunning attack?

I am writing to inquire feasible strategies to defeat Transaction Ordering Dependence (TOD) bugs. I learned from the best practice guideline such that we can use a so-called "pre-committed" scheme ...
0
votes
1answer
470 views

Setting up MyEtherWallet on iOS device from Coinbase

Can I securely set up and store a MyEthereumWallet on iOS only without an computer? I want to transfer ethers from Coinbase.
0
votes
1answer
42 views

Leverage short positions in decentralised PoW currencies

Hint I asked this question in a similar style already on bitcointalk and on bitcoin.stackexchange. But in these threads, there are no good answers and I thought maybe it would be better to ask the ...
0
votes
2answers
76 views

Is there a way to create double-spending transactions and submit them to different nodes?

I'm trying to create two transactions with the same nonce and send those transactions to two different nodes. Such as: const Web3 = require('web3'); const web3_1 = new Web3(rpcURL1); // node 1 const ...
0
votes
2answers
48 views

Sending extra data beside or inside a new smart contract

I'm doing a research about Ethereum smart contracts security and I need to send some extra data (for example some json data) beside or inside a new smart contract when I'm deploying that contract on ...
1
vote
2answers
30 views

How does proof of stake prevent past blocks from being changed?

I have a question about Proof of Stake. Are there any protections against a user just creating an entirely new chain, since there is no computational penalty for creating a really long chain, couldn't ...
0
votes
1answer
57 views

How to build security into Dapps?

I am building a loan dapp. The functionality is not easy to build but relatively straightforward. My question is though does anyone have any suggestions of how to build in user logins and security? ...
18
votes
1answer
4k views

How to access external knowledge / data in a smart contract

let’s say a contract wants to execute on knowledge contained outside the blockchain (e.g. whats the price of gold, what was the avg windspeed in NYC, how many people moved to portland in the last ...
0
votes
1answer
89 views

User anonymity while submitting data in smart contract

I've written a smart contract, that is a crowd sensing system. Where post posting a task user view that task and if they have what I'm asking for/and meet the task requirements they submit certain ...
54
votes
3answers
13k views

Why can't contracts make API calls?

The model that contracts can only accept and process data, instead of also being able to retrieve data from the Internet, seems limiting (even if not, it's less direct). If a concern is that data or ...
1
vote
0answers
16 views

Difference between SMTChecker and Manticore?

Why would I use Trail of Bits' Manticore over SMTChecker, which is baked in the Solidity compiler?
1
vote
0answers
38 views

msg.sender and tx.origin - how to use them in practice? [duplicate]

I wrote a contract A that uses msg.sender for authentication: When A creates an item it stores msg.sender in itemsOwners mapping (itemOwners[itemId] = msg.sender;). Later A compares msg.sender to ...
0
votes
2answers
964 views

Division/Percentages in Solidity (a workaround)

Division/percentages is a required part of many applications but is difficult to implement since fixed and ufixed are not supported yet in Solidity. I've come up with this workaround: pragma ...
0
votes
0answers
21 views

Validating transactions with ZK methods

After reading some topics on the implementation of ZK methods in the Ethereum, how would this affect the PoW? Please have someone correct me if I am wrong (I started recently), but if the nodes need ...
1
vote
0answers
18 views

Cost of forking Augur

Augur Version 2 is scheduled for launch on July 28th 2020. How can the cost of forking Augur version 2 (by disputing a market resolution) be calculated in REP? How dies this cost compare to the cost ...
0
votes
0answers
12 views

Suggest solution and/or literature on secure distributed voting

I'm a complete noob when it comes to blockchains and cryptocurrencies, but I am quite skilled with math and CS, so hopefully I am able to ask the correct questions and understand the answers For a ...
0
votes
1answer
37 views

Can someone read this private variable?

my purpose is to generate a random key when the smart contract is created and save that key in a private variable. I don't what to know its value either. Let's take for example the code below: pragma ...
2
votes
1answer
79 views

The blockchain trilemma

I understand that the generic blockchain faces a problem where it can choose to optimize between scalability, security and decentralization. I can see easily why scalability and decentralization are ...
0
votes
1answer
122 views

Quorum Consensus - BAR (Byzantine Altruistic Rational) Fault Tolerance / BAR Fault Tolerance / BAR Model

I refer to http://www.cs.utexas.edu/~dahlin/projects/bft/ http://www.cs.cornell.edu/lorenzo/papers/sosp05.pdf http://www.cs.northwestern.edu/~fabianb/classes/cs-443-w07/BAR.pdf https://blog.ethereum....
0
votes
1answer
36 views

How can I prove my friend having changed just one word in the seed and have it lay around is super insecure?

My friend said to me that he has his seed saved in Google Drive and that he is absolutely safe even if someone found it out. He even gave me his seed to try to break it. I know that all I have to do ...
0
votes
1answer
55 views

Front-running in Quorum IBFT

Are pending transactions processed sequentially in IBFT? In a networks based on PoW you would usually pay higher gas price in order to get your transaction mined first. Is there a way to manipulate ...
0
votes
1answer
68 views

Proxy function clashing - what kind of danger comes exactly with it?

I read that if I am using proxy, there is a chance of function clashing. Let's say in my contract there is a function with a signature: proxyOwner() ...
1
vote
2answers
98 views

Automatically test who can withdraw Ether from a smart contract

Is there any way I can automatically test who can withdraw ether from a smart contract? I need to perform this test automatically. So I cannot manually inspect the instructions. Can I design a smart ...
0
votes
1answer
25 views

Changing transaction validation process in Ethereum

I am doing a research about Ethereum smart contracts security. For this purpose I want to make some changes in Ethereum miner and transactions validation process (editing miner for automatically ...
0
votes
2answers
218 views

Web wallet best practices

I'm putting together an ether/erc20 token wallet in a chrome extension but would like to follow best practices with regards to private key security. I'm using localstorage to handle login and its ...
1
vote
1answer
39 views

Is a Hash Function really useful in a Smart Contract Election?

Noob here. Was reading this: https://karl.tech/learning-solidity-part-2-voting/ From my basic understanding, a hash function: Receives an input (like x) and spits some result (like y) y is ...
0
votes
1answer
23 views

It is secure do accounts just with web3.eth.accounts.create() ? (entropy)

const Web3 = require('web3'); let url = 'infuralink'; let web3 = new Web3(url); console.log(web3.eth.accounts.create()); This is the code of many tutorials for do a key pair. it is completely secure ...
0
votes
1answer
130 views

Security Implications of allowing remote RPC connections to Geth Node

What are the security Implications of allowing remote RPC connections to Geth Node? If one absolutely needs to allow remote rpc connections for web3 connection, how can one do this while securing the ...
0
votes
0answers
19 views

How do I store or use private keys in node js that I deploy in live server?

I have a live server running a full GETH NODE in which I need to sign a transaction with a private key. The problem is I dont know how I can use the private key without explicitly providing the ...

1
2 3 4 5
12