Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
0
votes
0answers
24 views

Safe implementation on Solidity 0.8.0 of a withdrawal and a refund

I'm here for asking of a SECURE way to implement on solidity 0.8.0 two functions: 1-Withdrawal() which sends all the ether of the smart contract to the owner address. My current implementation is: //...
1
vote
1answer
41 views

Security implementation of a function in Solidity

I'm here for asking some tips on calling function from other contracts in solidity. Here is the function for generating a random number (which I need in the main contract) using the chainlink VRF. ...
0
votes
0answers
20 views

What is the legitimate use case of using library contract without using contract address?

Let us look at the following contract contract LibraryA { function getSenderAddress() public returns (address); } contract LibraryB { function getSenderAddress() public returns (address);...
2
votes
0answers
54 views

Even if I own 51% of stake (or have 51% computational power) and try to cheat, can't others still see that my block is invalid?

I'm thinking about how proof of stake works exactly. As I understand, here is how it is secure: I cannot forge a tx where random A pays me X amount because I would need the private keys of A. ...
1
vote
0answers
11 views

eip-1967 address calculation

I have read EIP-1967 and i have study how work proxy contracts. There is something i do not understand in EIP-1967. Here is what i have understood: Logic contract's storage variables are stored in ...
0
votes
0answers
11 views

What is the best practice when storing a custodial wallet with node.js and mysql?

I'm using Adonis.js v4 (it's node.js) and mysql (on RDS) as my database. I need to create an ethereum wallet for each of my user's and I need to make transaction on their behalf with their wallet (...
0
votes
0answers
21 views

one wallet address, multiple users, what is the best way to keep the private key secured?

I would like to develop an application using the web3j. However, it needs to be just one wallet that multiple users will deposit and withdraw from. The allowances are kept in a centralized database. ...
0
votes
3answers
44 views

Do view functions cause reentrancy vulnerabulity?

It's well known that calling an external function before changing something in the contract causes a security problem called "reentrancy vulnerability". Does calling an external function ...
0
votes
0answers
18 views

Is it possible for an attacker to exploit contracts that rely on incoming “msg.value”?

I am developing an eth2.0 fuzzer for my masters that has produced some interesting crashes - if these crashes are legitimate I believe I may have found a new vulnerability - otherwise, I still have a ...
0
votes
1answer
16 views

If contracts can be proxied to other contracts, how can a user trust them?

Based on the upgradeable smart contract pattern, a smart contract author can create a contract x that proxies to contract y. Let's say the contract is an ERC20 token where Alice buys 100 tokens. How ...
0
votes
1answer
14 views

Why is sending ETH from multiple accounts in a single transaction deemed a “security hole”?

A user on Ethereum SE posted the following As you noticed, there is no way to send a single from multiple addresses. There is always just one sender. For Ether transfers the Ether value is always ...
3
votes
1answer
112 views

Explain “griefing” attack on Aave flash loan

Aave doc about flash loan warns to never store funds inside a receiver contract as it can be exposed to "griefing" attack. So my questions are Can you give an example of this attack? How ...
1
vote
1answer
50 views

How are Metamask web wallets traceable to owner identity?

When creating a Metamask wallet as a Chrome browser extension, what are all the different identifiers that match the wallet to its owner? Since it takes a password to log into the Metamask wallet, ...
0
votes
2answers
40 views

Can Ethereum wallets be deleted for fraud?

Stellar Foundation, who created the Stellar Lumens coin (XLM), are able to shut down XLM addresses that engage in fraud. Stellar scammers often send small payments to other XLM wallets at random with ...
0
votes
0answers
11 views

Why is serprent considered untrusted?

Serpent was way to fetch Diesel prices from the oraclize api at fixed intervals. On GitHub, it s written audits proved the code to be flawed, but where are such audits? I m meaning why is it flawed?
0
votes
0answers
11 views

About security problem on hard fork named “Spurious Dragon”

What is the specific problem with the secuirty of "Spurious Dragon" (EIP-170)? I've heard that EXTCODESIZE isn't checked when accessing the constructor and doesn't cost a gas fee, but I'm ...
0
votes
0answers
13 views

private network impersonation attack

I've set up a 5-node network with 3 validator nodes. I would like to test the integrity of the blockchain by having a non-validator node attempt to validate a new transaction. How can I go about doing ...
1
vote
1answer
35 views

The security of JSON-RPC

I currently use web3 and geth to develop dapps, and we know that web3 interacts with geth through json rpc. If we want to unlock an account through dapp, we need to enter the password in the dapp, and ...
1
vote
1answer
18 views

How to properly invalidate the manager?

In MyContract, I am providing special rights to the manager. But after some time and for some reason, I want to invalidate the manager. The following is my approach: // SPDX-License-Identifier: GPL-3....
0
votes
1answer
35 views

Deploy basic proxy with arguments

https://github.com/optionality/clone-factory/blob/master/contracts/CloneFactory.sol#L32 contains a code to deploy a basic proxy. This code misses a way to pass data to the proxied contract to init it. ...
1
vote
1answer
36 views

The security problem of tx.origin in Solidity

The book Mastering Ethereum pointed out that it is not safe to use tx.origin in smart contracts. I want to know what is the reason for insecurity?
0
votes
0answers
13 views

Is it possible for miner to tamper with the results when executing smart contracts?

When Miner A executes the smart contract, a result is generated and broadcast to the entire network. I want to know if this result may have been tampered with. If this is possible, how do other miners ...
0
votes
1answer
30 views

The security of private key with geth on the server-side

If you initiate a transaction in real time, you need to store the private key on the geth server to initiate the transaction. Once the geth server is hacked, the private key may be leaked. Is there ...
1
vote
1answer
40 views

Can the Geth password be cracked

When we create a new user in Geth, we need to enter a password. When initiating transactions in the future, you also need to use this password to unlock the account first. I want to know where the ...
0
votes
0answers
12 views

When calling eth_getLogs, should I worry if a block is mined?

I call eth_getLogs to store some data in the database. In https://eth.wiki/json-rpc/API#eth_getLogs it says: fromBlock: QUANTITY|TAG - (optional, default: "latest") Integer block number, or &...
1
vote
1answer
14 views

Is it okay to store your private key on Ubuntu server in .env?

Lets say you have to sign transactions / messages real-time. It seems I must store the private key in the server. What if the address stores millions of dollars of value? Is simple LEMP server enough ...
0
votes
2answers
18 views

Existing research about m-of-n paper seed phrases

I'm interested in designing a protocol that stores a seed phrase for a crypto wallet across N separate pieces of paper (or metal!), where any M of the pieces of paper can reconstruct the seed phrase, ...
1
vote
1answer
28 views

Reentrancy protection against multiple entries at once

I'm concerned about the security of the Reentrancy pattern that we can use in Solidity to prevent from calling multiple times a same function at the same time. This protection is nicely implemented ...
1
vote
0answers
50 views

What s the fake deposit attack affecting some exchanges with erc20?

There are a lot of articles about hacked tokens affecting centralized exchanges only when Googling fake erc20 deposit but I failed to find a reference describing how the attack works technically. The ...
0
votes
0answers
30 views

How can I have no gas fees in a private PoA network while avoiding spam attacks and the halting problem?

Complete noob here. I'm developing a dApp that functions on top of a private clique PoA blockchain (using geth). The project should be viable in a production environment and allow nodes to transact ...
1
vote
0answers
69 views

Flash minting ether security considerations and attacks

Flash loans enable a class of attacks that have not been possible or observed as much in prior systems. Flash minting ether is a concept that is starting to be implemented. See Example of flash ...
8
votes
4answers
649 views

Flash loan security considerations and attacks

What do developers need to be aware of to make their contracts and systems safe against flash loans? What do they have to think about and protect against?
0
votes
1answer
56 views

Is it bad idea to store my passwords on blockchain with a smart contract?

I want to save my passwords and some other personal data on a ethereum like blockchain. it seems more persistant to me. I may lose my e-mail , my pc may crush and I may lose my usb stick. But nothing ...
0
votes
0answers
22 views

Is it bad idea to store my passwords on blockchain with a smart contract? [duplicate]

I want to save my passwords and some other personal data on a ethereum like blockchain. it seems more persistant to me. I may lose my e-mail , my pc may crush and I may lose my usb stick. But nothing ...
0
votes
0answers
22 views

How to work with MythX in a Truffle project to analyze a contract?

I work with Truffle and Windows Powershell. I have a smart contract. Now, I want to analyze the contract's security with Mythx. For that, I installed pip3 to install MythX CLI after that. Now, I have ...
0
votes
1answer
27 views

An attack to my contract similar to ERC-20 approval() exploit

I have function setNonRecurringFlow(uint256 _child, int256 _remainingSwapCredit) external; function setRecurringFlow( uint256 _child, int256 _maxSwapCredit, int256 ...
0
votes
1answer
21 views

Need to execute several transactions as fast as possible

In the case of an emergency (e.g. theft), it may be necessary to disable several accounts as fast as possible. I am writing the smart contract. Should each of several accounts be disabled in a ...
0
votes
0answers
10 views

How do two parties verify a transaction initially?

Sorry for the beginner question. Im trying to understand how a blockchain transaction is initially verified by both parties. I think I understand the process of externally verifying a transaction but ...
0
votes
0answers
24 views

_transferFrom vs. _burnFrom order of operations (Zeppelin ERC20burnable.sol)

I have question, more for my understanding than anything. Here’s the transferFrom function in the ERC20 standard: function transferFrom(address sender, address recipient, uint256 amount) public ...
0
votes
0answers
33 views

Proof-of-Stake: How to prevent someone from being always selected as an author of block? [duplicate]

In proof-of-stake, by definition, each stakeholder deposits and locks some tokens (stakes) for more chances to be selected as an author of block in a random-based election procedure. Till here, it's ...
2
votes
1answer
40 views

Is there a way to verify transactions afterwards they are entered in the ethereum blockchain?

Suppose I sent a signed transaction using the web3.js library. But, I might be using some third party API like an Infura node or others. So there are chances of attacks and data manipulation. So, is ...
0
votes
1answer
23 views

How is transferFrom secure?

function transferFrom(address sender, address recipient, uint256 amount) public virtual override returns (bool) { _transfer(sender, recipient, amount); _approve(sender, _msgSender(), ...
0
votes
1answer
14 views

Token Restrictions Helping me Understand Blockchain Logic

To execute the transfer or transferFrom ERC-20 token functions in a Solidity contract, ie: // moves token from contract to personal address ERC20Token.transfer(msg.sender, tokenamount); // ...
1
vote
1answer
12 views

If you're a node, why would you accept other node's solution instead of copying and broadcasting that solution?

Let's say someone broadcasted a solution to the recent block. Why, as a node, would I accept it? I can just copy and broadcast it myself instead. Yes, most of the times the first node would win, but ...
2
votes
0answers
599 views

Frontrunning Uniswap horror story transactions

From the Ethereum is a Dark Forest post, the rescue plan was: Deploy a Getter contract which, when called by its owner, would make the burn call ONLY if activated, and otherwise revert. Deploy a ...
0
votes
0answers
18 views

Avoiding contract impersonation

Newbie question. Suppose I have contract X which have a foo function which accepts contract of type Y and calls function bar on it like this. contract Y { function bar() public; } contract X { ...
1
vote
0answers
21 views

Is there any free-to-use scenario builder?

The Compound Protocol has a collection of high-level integration tests, dubbed "scenarios": https://github.com/compound-finance/compound-protocol/tree/v2.8.1/spec Which look like this: Test &...
1
vote
2answers
50 views

How does proof of stake prevent past blocks from being changed?

I have a question about Proof of Stake. Are there any protections against a user just creating an entirely new chain, since there is no computational penalty for creating a really long chain, couldn't ...
1
vote
1answer
28 views

Difference between SMTChecker and Manticore?

Why would I use Trail of Bits' Manticore over SMTChecker, which is baked in the Solidity compiler?
1
vote
0answers
40 views

msg.sender and tx.origin - how to use them in practice? [duplicate]

I wrote a contract A that uses msg.sender for authentication: When A creates an item it stores msg.sender in itemsOwners mapping (itemOwners[itemId] = msg.sender;). Later A compares msg.sender to ...

1
2 3 4 5
12