Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
0
votes
2answers
53 views

hacked from metamask wallet

yesterday 2.3.2021 at 18:25 i was hacked. they stole all my founds from metamusk wallet from my address 0xeD14989682D3770AC0a9AEB2608Aa2315cF312Df and took everything to this address ...
0
votes
0answers
14 views

Why this delegatecall attack not working?

I am confused by this simple contract. The main purpose is to bypass the OnlyContract() modifier. Victim contract. pragma solidity 0.7.6; contract Victim { modifier OnlyContract() { ...
0
votes
2answers
223 views

Web wallet best practices

I'm putting together an ether/erc20 token wallet in a chrome extension but would like to follow best practices with regards to private key security. I'm using localstorage to handle login and its ...
3
votes
2answers
58 views
+100

What if a chain is compromised?

I have deployed a dApp on a sidechain (namely xDai) and am worried about its security. What happens if an EVM chain is compromised? Will it be rolled back after a few hours? or what? If the mainnet is ...
0
votes
1answer
23 views

What is the legitimate use case of using library contract without using contract address?

Let us look at the following contract contract LibraryA { function getSenderAddress() public returns (address); } contract LibraryB { function getSenderAddress() public returns (address);...
0
votes
1answer
27 views

Authentication between smart contracts based their addresses - Is it safe?

thanks in advance for your time and intellectual contribution. I am working on a project in which we have contracts interacting which each other. More specifically, there is a "father contract&...
0
votes
0answers
35 views

Safe implementation on Solidity 0.8.0 of a withdrawal and a refund

I'm here for asking of a SECURE way to implement on solidity 0.8.0 two functions: 1-Withdrawal() which sends all the ether of the smart contract to the owner address. My current implementation is: //...
1
vote
1answer
47 views

Security implementation of a function in Solidity

I'm here for asking some tips on calling function from other contracts in solidity. Here is the function for generating a random number (which I need in the main contract) using the chainlink VRF. ...
0
votes
1answer
299 views

Threat Model Question - Code Injection / ROP possible in Ethereum Smart Contracts?

I am trying to understand a basic threat model for Ethereum Smart Contracts, to perform some research on how existing attacks techniques may be applied here as well. Is there a risk of a contract with ...
2
votes
0answers
56 views

Even if I own 51% of stake (or have 51% computational power) and try to cheat, can't others still see that my block is invalid?

I'm thinking about how proof of stake works exactly. As I understand, here is how it is secure: I cannot forge a tx where random A pays me X amount because I would need the private keys of A. ...
1
vote
0answers
15 views

eip-1967 address calculation

I have read EIP-1967 and i have study how work proxy contracts. There is something i do not understand in EIP-1967. Here is what i have understood: Logic contract's storage variables are stored in ...
1
vote
1answer
81 views

How does this function potentially violates the Checks-Effects-Interaction pattern?

I am developing a smart contract that integrates with the DAI stable coin. In the function below, you can see that I have followed the check effects interaction pattern, so how come I still get a ...
2
votes
1answer
62 views

In the case the Zerofunctionselector bug, how to know which function NAME has a 0 selector?

Normally, If a smart contract is not affected by the Zerofunctionselector bug, then at the end of the code which makes jump to the target function lies a 0xfe opcode (which result in the smart ...
0
votes
1answer
162 views

Are there any security issues to send token in fallback function?

I want to have a contract that releases an erc-20 token as soon as someone pays ether to contract. Let's call this contract Bid Contract. The abstract code goes like: function askForTokens() public ...
19
votes
5answers
6k views

Is there any safe way to send money from a cold wallet, using an untrusted computer?

You have 2 computers. One is 100% offline and, thus, trusted. Other is online. Private keys are stored on the offline computer and the online computer has no access to it. Is there any way to sign a ...
0
votes
3answers
46 views

Do view functions cause reentrancy vulnerabulity?

It's well known that calling an external function before changing something in the contract causes a security problem called "reentrancy vulnerability". Does calling an external function ...
0
votes
1answer
220 views

transfer/send error cases

I have a (noob) question on the usage of transfer and send. I have seen that transfer is equivalent to require(x.send(k)); When I use send() I know that I have to check whether there was an error ...
-1
votes
1answer
240 views

Trying to figure out this 2 ETH smart contract quiz

Does anyone know whether this smart contract can be broken? Is there some trick behind this? https://etherscan.io/address/0xfc62a32da21052fb3086e8f68ad10a7118a98606
0
votes
0answers
12 views

What is the best practice when storing a custodial wallet with node.js and mysql?

I'm using Adonis.js v4 (it's node.js) and mysql (on RDS) as my database. I need to create an ethereum wallet for each of my user's and I need to make transaction on their behalf with their wallet (...
1
vote
1answer
29 views

Difference between SMTChecker and Manticore?

Why would I use Trail of Bits' Manticore over SMTChecker, which is baked in the Solidity compiler?
1
vote
3answers
180 views

How to prevent frontrunning: someone running a transaction before me?

Let's say I have the following in my smart contract: string passwordHash; uint money; function checkPassword(string cleanPassword, string newPasswordHash)[...] When running the function ...
0
votes
0answers
26 views

one wallet address, multiple users, what is the best way to keep the private key secured?

I would like to develop an application using the web3j. However, it needs to be just one wallet that multiple users will deposit and withdraw from. The allowances are kept in a centralized database. ...
0
votes
1answer
17 views

If contracts can be proxied to other contracts, how can a user trust them?

Based on the upgradeable smart contract pattern, a smart contract author can create a contract x that proxies to contract y. Let's say the contract is an ERC20 token where Alice buys 100 tokens. How ...
0
votes
0answers
18 views

Is it possible for an attacker to exploit contracts that rely on incoming “msg.value”?

I am developing an eth2.0 fuzzer for my masters that has produced some interesting crashes - if these crashes are legitimate I believe I may have found a new vulnerability - otherwise, I still have a ...
8
votes
1answer
264 views

Is ethereumwallet.com generating the keys client-side?

Is ethereumwallet.com generating the all the keys, accounts and transactions client-side? Is it legit and safe to use? Is it possible to confirm the javascript has no backdoors? Can it be trusted?
3
votes
1answer
125 views

Explain “griefing” attack on Aave flash loan

Aave doc about flash loan warns to never store funds inside a receiver contract as it can be exposed to "griefing" attack. So my questions are Can you give an example of this attack? How ...
0
votes
1answer
14 views

Why is sending ETH from multiple accounts in a single transaction deemed a “security hole”?

A user on Ethereum SE posted the following As you noticed, there is no way to send a single from multiple addresses. There is always just one sender. For Ether transfers the Ether value is always ...
1
vote
1answer
56 views

How are Metamask web wallets traceable to owner identity?

When creating a Metamask wallet as a Chrome browser extension, what are all the different identifiers that match the wallet to its owner? Since it takes a password to log into the Metamask wallet, ...
1
vote
2answers
569 views

Automatic transaction

I would like to know if it was possible to automatically send any ETH amout to an address "B" just after receiving them on an address "A"? Maybe via a script? I need help
0
votes
2answers
42 views

Can Ethereum wallets be deleted for fraud?

Stellar Foundation, who created the Stellar Lumens coin (XLM), are able to shut down XLM addresses that engage in fraud. Stellar scammers often send small payments to other XLM wallets at random with ...
0
votes
0answers
11 views

Why is serprent considered untrusted?

Serpent was way to fetch Diesel prices from the oraclize api at fixed intervals. On GitHub, it s written audits proved the code to be flawed, but where are such audits? I m meaning why is it flawed?
1
vote
2answers
59 views

Dos with revert

While I was reading a guide on smart contract security (by consensys) I found this: // INSECURE contract Auction { address currentLeader; uint highestBid; function bid() payable { ...
5
votes
2answers
2k views

Honest lottery winner generation - pseudo random number obtaining

Suppose I would like to organize a honest lottery and prevent cheating when we need to find a winner. I known problem of random number in the known network arises. I would like to try the following ...
0
votes
0answers
13 views

About security problem on hard fork named “Spurious Dragon”

What is the specific problem with the secuirty of "Spurious Dragon" (EIP-170)? I've heard that EXTCODESIZE isn't checked when accessing the constructor and doesn't cost a gas fee, but I'm ...
1
vote
1answer
72 views

Access manager in Smart Contract

I'm building a service where one can publish a crypted file on the internet which can be accessed and decrypted by people allowed. I don't want to store any crypted key on a server or something. For ...
0
votes
0answers
13 views

private network impersonation attack

I've set up a 5-node network with 3 validator nodes. I would like to test the integrity of the blockchain by having a non-validator node attempt to validate a new transaction. How can I go about doing ...
0
votes
1answer
88 views

ERC20 vulnerability? Executing transferFrom undesirably

Say I have a contract called MyContract, and I require to send 100000 DAI to it. Ideally, I'd firstly call approve(<address of A>, 100000e18) in DAI's contract itself. Secondly, I'd execute, for ...
0
votes
1answer
35 views

Deploy basic proxy with arguments

https://github.com/optionality/clone-factory/blob/master/contracts/CloneFactory.sol#L32 contains a code to deploy a basic proxy. This code misses a way to pass data to the proxied contract to init it. ...
1
vote
1answer
19 views

How to properly invalidate the manager?

In MyContract, I am providing special rights to the manager. But after some time and for some reason, I want to invalidate the manager. The following is my approach: // SPDX-License-Identifier: GPL-3....
1
vote
1answer
36 views

The security of JSON-RPC

I currently use web3 and geth to develop dapps, and we know that web3 interacts with geth through json rpc. If we want to unlock an account through dapp, we need to enter the password in the dapp, and ...
1
vote
1answer
63 views

adaptive vs. non-adaptive adversaries? Is there a precise, unique and general definition? (Updated)

In this Ethereum github page (Link to the page: https://github.com/ethereum/wiki/wiki/Sharding-FAQ#what-are-the-security-models-that-we-are-operating-under) there is a very brief definition of the ...
0
votes
2answers
121 views

Is there a way to create double-spending transactions and submit them to different nodes?

I'm trying to create two transactions with the same nonce and send those transactions to two different nodes. Such as: const Web3 = require('web3'); const web3_1 = new Web3(rpcURL1); // node 1 const ...
0
votes
1answer
474 views

Setting up MyEtherWallet on iOS device from Coinbase

Can I securely set up and store a MyEthereumWallet on iOS only without an computer? I want to transfer ethers from Coinbase.
1
vote
1answer
45 views

The security problem of tx.origin in Solidity

The book Mastering Ethereum pointed out that it is not safe to use tx.origin in smart contracts. I want to know what is the reason for insecurity?
0
votes
1answer
47 views

Leverage short positions in decentralised PoW currencies

Hint I asked this question in a similar style already on bitcointalk and on bitcoin.stackexchange. But in these threads, there are no good answers and I thought maybe it would be better to ask the ...
0
votes
0answers
13 views

Is it possible for miner to tamper with the results when executing smart contracts?

When Miner A executes the smart contract, a result is generated and broadcast to the entire network. I want to know if this result may have been tampered with. If this is possible, how do other miners ...
0
votes
1answer
74 views

How to build security into Dapps?

I am building a loan dapp. The functionality is not easy to build but relatively straightforward. My question is though does anyone have any suggestions of how to build in user logins and security? ...
0
votes
1answer
33 views

The security of private key with geth on the server-side

If you initiate a transaction in real time, you need to store the private key on the geth server to initiate the transaction. Once the geth server is hacked, the private key may be leaked. Is there ...
1
vote
1answer
41 views

Can the Geth password be cracked

When we create a new user in Geth, we need to enter a password. When initiating transactions in the future, you also need to use this password to unlock the account first. I want to know where the ...
8
votes
4answers
661 views

Flash loan security considerations and attacks

What do developers need to be aware of to make their contracts and systems safe against flash loans? What do they have to think about and protect against?

1
2 3 4 5
12