Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
0
votes
0answers
27 views

Who is 0x093a0ed738b65ed34f2a37a2d44c5e3cd0d0dd45?

I was working with ethereum using: - solcjs web3 truffle public no firewall kovan node (parity) and MultiSigWallet.sol from https://github.com/gnosis/MultiSigWallet And when I checked my wallet in ...
0
votes
0answers
9 views

Drizzle Dapp on HTTP vs. HTTPS

If I have a Drizzle dap on an http server. Is there a risk that the private keys used with this dapp can be revealed? I suppose this is like asking if a MetaMask interaction within the unsecure http ...
2
votes
0answers
20 views

Protocol for Response to Ethereum Account Hack [closed]

Last week a single Ethereum account in my wallet was hacked. When I send ETH to it, within 2 blocks the hacker-bot uses my private key and sends 0.0009 ETH to another account and then maxes out the ...
1
vote
3answers
46 views

Is it possible to deploy a contract on the same address after self-destruct?

As far as I understand self-destruct simply deletes the code from a contract and turns it into a regular wallet + it sends all funds to caller/argument. But is there a way to recreate the contract? I ...
1
vote
0answers
25 views

Sending secure transactions using web3.py

An ethereum account I had has been hacked, where whenever I send it, say, 0.1 eth, some evil bot immediately sends 0.0009 eth from that account to a dummy account, and then spends the remaining 0.0991 ...
0
votes
0answers
36 views

Can ETH be hacked by inserting a forwarding contract?

Just to be clear I am not going to name any companies in this post since there is still an investigation going on as to how this happened. As you can guess by the question ETH has been stolen from me,...
0
votes
1answer
16 views

Calling transferFrom of external erc20 contract

Hey I'm calling externals contract method transferFrom in following way. function sendTransaction(address tokenAddress, uint tokenAmount) public payable { if (!performTransfer(tokenAddress, ...
0
votes
1answer
25 views

Lottery Winning number based on blockhash

After reading a lot of Info about this topic in this forum I am asking whether I can just use the formular winningNumber = uint256(blockhash(block.number-1)) % 100; e.g. 10 or 20 blocks after the ...
1
vote
1answer
17 views

Information Regarding LASER and Ethereum

I was reading this article https://diligence.consensys.net/files/D1T2%20-%20Bernhard%20Mueller%20-%20Smashing%20Ethereum%20Smart%20Contracts%20for%20Fun%20and%20ACTUAL%20Profit.pdf and came across ...
1
vote
1answer
32 views

Difference between MythX and Mythril for security auditing

I know that both mythrix and mythril are used for smart contracts auditing but I didn't figure out yet the difference between them. I'll appreciate any help.
0
votes
0answers
33 views

what is wrong with this token contract?

This one: https://etherscan.io/address/0xc12d1c73ee7dc3615ba4e37e4abfdbddfa38907e As you can see most of the last transfer fail, the transfer function is: function transfer(address recipient, ...
0
votes
0answers
21 views

Security implications on limiting the round change timeout of Istanbul BFT consensus algorithm?

I have a security-related question regarding the exponentially increasing timeout in the round change, which is used in the Istanbul Byzantine fault-tolerance consensus algorithm used by Quorum. ...
0
votes
0answers
20 views

How to trace transactions to get information about hot and cold wallets?

I am researching ways how to trace transactions to get data about hot and cold wallets of exchanges, gambling sites, cantors, mixers. What sources of data could I use? What algorithms and scripts ...
0
votes
1answer
31 views

Sharing an verifiable secret message in a contract

I would like to hear your opinion on my idea to share a proof of a secret message in a contract, that users can verify later in a second phase when the message will be revealed. If the message is a ...
1
vote
2answers
26 views

How can I find out the sender's gas limit?

Is there a way to check Sender's Gas Limit? If the sender sets too low, I will just accept whatever gas amount that he had set and return immediately without hitting the limit. I am trying to ...
1
vote
2answers
41 views

Is it possible to circumvent a require statement if the ordering of the requirements are incorrect?

Please take the following hypothetical code as an example mapping (address => uint256) public accountBalance; function deposit(uint256 amount) public { accountBalance[msg.sender] = ...
1
vote
1answer
36 views

How does this function potentially violates the Checks-Effects-Interaction pattern?

I am developing a smart contract that integrates with the DAI stable coin. In the function below, you can see that I have followed the check effects interaction pattern, so how come I still get a ...
0
votes
2answers
53 views

How to fight against a cheating node?

As far as I know, there are roughly two kinds of contract calls on Ethereum. One kind is intended to change the global state of blockchain (i.e. change some storage values or transfer money). The ...
1
vote
1answer
45 views

Is it safe to do multiple payments in between locks (Reentrancy Guard)?

https://diligence.consensys.net/blog/2019/09/stop-using-soliditys-transfer-now/ provides a simple example related to using a Reentrancy Guard. Another approach to preventing reentrancy is to ...
3
votes
1answer
391 views

What's the vulnerability in my contract?

I've got a contract deployed at 0xe559835D7979dAe994331DEfaEc2FBA057E56C27 on the mainnet. Every time I go to call the payable function, which is solve, a bot beats me to it. My transaction gets ...
1
vote
1answer
30 views

private key vs seed

I made an extra account in Metamask for my GF, I kept Account 1 for myself and I gave only the private key of Account 2 to my GF. I kept the seed words only to myself. Since then, she has dumped me ...
1
vote
1answer
24 views

Is it considered secure at all to use passwords and private keys in the code of smart contract?

Basically something like: function transfer(address to, string privkey) { if(privkey == "cd33434343...") { msg.sender.transfer(this.balance); } } The above is obviously flawed since the privkey is ...
0
votes
1answer
23 views

Is function like this one reentrant?

Got this in pseudo-code (Solidity like...) from audit of past work of person from our company, in short it seems to be withdrawing first and adding later. Maybe not a good idea, especially since it's ...
1
vote
0answers
17 views

How dangerous is this: number of contracts contain a function like “approveandcall” which lets anyone call any contract (some thoughts?)

The most common implementation is as follows: function approveAndCall(address _spender, uint256 _value, bytes _extraData) public returns (bool success) { tokenRecipient spender = tokenRecipient(...
2
votes
2answers
46 views

Revert()/throw/invalid are so powerful they can even put back an already self-destructed contract, but is there a way to surpass such limitation?

I know this sounds confusing so let me explain: In this case below a transaction will succeed and a contract will be first destroyed and then re-initialized on the same address (yes, I didn't think ...
1
vote
1answer
30 views

Are simultanous transactions possible (basic but potentially very dangerous security concern…most likely impossible…)?

Long story short I am curious how a contract stores variables in memory, so is it possible to spam say 100 transactions at once and the values to be changed afterwards...I am sure I am giving bad ...
1
vote
1answer
41 views

How are transfer and send protecting against reentrancy if the gas is taken from the EOA (msg.sender)?

I guess transfer and send simply allow 2300 gas but no gas is taken from the contract? In other words if a wallet calls this function with say one million wei gas: function sending() public payable { ...
2
votes
1answer
33 views

How dangerous is to use tx.origin to check if msg.sender is some address? (details below…)

Let's say: function transfer() public payable { require(tx.origin == 0xb2930B35844a230f00E51431aCAe96Fe543a0347); msg.sender.call.value(1 ether)(); } Ignore the address above I just copied it ...
0
votes
0answers
14 views

Is function like that prone to reentrancy?

function transfer() payable public returns(bool) { balances[msg.sender] = SafeMath.sub(balances[msg.sender], msg.value); if(msg.sender.call.gas(100000).value(msg.value)()) { ...
5
votes
1answer
571 views

Is transfer() still safe after the Istanbul update?

In other words, is using transfer() safe? function transfer(address contractB) public { contractB.transfer(1000); //balances[msg.sender] -= 1000; } How about using call.gas? function ...
0
votes
1answer
33 views

Is there a case in which selfdestruct is more “powerful” than throw or revert?

Example in this scenario I guess selfdestruct will never get called (also: contract A isn't so important by the way just focus on B onward): in Contract A: address contractb = 0x....; function ...
0
votes
1answer
16 views

Can you change a variable outside of a function (assuming this variable may be a constant)?

In other words if a contract looks like this: contract tokenX { bool public started = true; function end() { started = false; } } So everyone should be able to call end() but can someone call "...
0
votes
1answer
44 views

Alternate to Allowing Insecure Unlock

Several places say insecure unlock is poor practice. Yet this module I am learning implements it. Where can I find a way to Deploy an account without insecure unlock Here is repository with files I ...
0
votes
0answers
83 views

Unable to Unlock Account Even After specifying allow-insecure-unlock

Software: Ubuntu on VirtualBox Update, tried putting two dashes, on allow-insecure-unlock, doesn't work solidity@solidity:~$ geth attach http://127.0.0.1:8545 --allow-insecure-unlock Incorrect Usage:...
0
votes
0answers
16 views

Problem with understanding the solution for Transaction Ordeing Vulnerability

For the following paper, I can’t understand the text written below: https://arxiv.org/pdf/1806.01143.pdf Our violation pattern checks that the amount of the call instruction is determined by a ...
0
votes
0answers
15 views

Backward program analysis (like symbolic backward execution) tools for smart contracts

I know there are some backward program analysis tools for traditional softwares, but i wonder if there are already backward symbolic execution tools for smart contracts, or any tool that I can refer ...
0
votes
1answer
39 views

ERC20 vulnerability? Executing transferFrom undesirably

Say I have a contract called MyContract, and I require to send 100000 DAI to it. Ideally, I'd firstly call approve(<address of A>, 100000e18) in DAI's contract itself. Secondly, I'd execute, for ...
0
votes
1answer
38 views

How dangerous the 'short address' attack is as of 2019, October and what ways there are to mitigate it?

From what I read there's a well public knowledge of reantrancy and underflows/overflows due to the cases of documented hacks and stolen ether - yet the short address attack seems less known. I know in ...
0
votes
2answers
39 views

Is there a way to create double-spending transactions and submit them to different nodes?

I'm trying to create two transactions with the same nonce and send those transactions to two different nodes. Such as: const Web3 = require('web3'); const web3_1 = new Web3(rpcURL1); // node 1 const ...
0
votes
1answer
41 views

How to build security into Dapps?

I am building a loan dapp. The functionality is not easy to build but relatively straightforward. My question is though does anyone have any suggestions of how to build in user logins and security? ...
0
votes
0answers
18 views

Hidding IP address behind sentry nodes

I would like to know how to set up an Ethereum node behind sentries (proxy nodes). I know there are several ways to approach this issue as mentioned here. https://medium.com/@kidinamoto/tech-choices-...
0
votes
1answer
16 views

Can a miner delay a transaction?

Say that my wallet is connected to a malicious miner. Of course this miner can DoS me and ignore all my transactions, but can they withhold it and release it to the network in the future? Or is the ...
0
votes
0answers
31 views

Can you verify transaction data by matching it to the transaction hash

TlDr; Can you use the transaction hash to confirm the integrity of the data components of a transaction (post data, addresses, nonce, etc). In my application, I have a connection to the Ethereum ...
0
votes
1answer
40 views

dApp design and security question

I'm designing a dApp where users can submit work they've done (files) to ipfs/swarm. To get credit for the work they then reference the hash of the files when calling a smart contract. What are some ...
1
vote
0answers
27 views

Is there a curated list of known security vulnerabilities related to escrow?

In Factories Improve Smart Contract Security, Steve Marx says that: This bug was hand-picked to show the benefit, but this bug is representative of a large class of bugs around escrow. In my ...
4
votes
1answer
48 views

Why is the subcall gas limit set to 63/64th of the remaining gas?

From the solidity docs: Calls are limited to a depth of 1024, which means that for more complex operations, loops should be preferred over recursive calls. Furthermore, only 63/64th of the gas can ...
1
vote
1answer
27 views

Why OpenZepplin always use private visibility for state variables?

Why OpenZepplin always use private visibility with getter functions for its state variables? I can't find a reason why they are not using public, is there any potential security or gas cost difference ...
0
votes
1answer
34 views

Gas optimisation for my art experiment spacecans.com

so I was microdosing some research chems and the thought came to me that I need to do some artsy blockchain stuff for once. It's two tin cans floating in space that you can advertise your so-called ...
2
votes
1answer
36 views

Getter functions for loop security

Is there any security issue when making for-loops inside getter functions ? Let's say the array is very large, and it takes a long time to loop through the array. Is it a potential threat or I can ...
1
vote
0answers
37 views

Help hacking this contract

This is a very simple contract that I can't hack and I'm stuck, I need some help to get the concepts right. pragma solidity ^0.4.10; contract SimpleToken { mapping(address => uint) public ...

1
2 3 4 5
11