Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
0
votes
1answer
18 views

Lottery Winning number based on blockhash

After reading a lot of Info about this topic in this forum I am asking whether I can just use the formular winningNumber = uint256(blockhash(block.number-1)) % 100; e.g. 10 or 20 blocks after the ...
1
vote
1answer
16 views

Information Regarding LASER and Ethereum

I was reading this article https://diligence.consensys.net/files/D1T2%20-%20Bernhard%20Mueller%20-%20Smashing%20Ethereum%20Smart%20Contracts%20for%20Fun%20and%20ACTUAL%20Profit.pdf and came across ...
1
vote
1answer
21 views

Difference between MythX and Mythril for security auditing

I know that both mythrix and mythril are used for smart contracts auditing but I didn't figure out yet the difference between them. I'll appreciate any help.
0
votes
0answers
33 views

what is wrong with this token contract?

This one: https://etherscan.io/address/0xc12d1c73ee7dc3615ba4e37e4abfdbddfa38907e As you can see most of the last transfer fail, the transfer function is: function transfer(address recipient, ...
0
votes
0answers
20 views

Security implications on limiting the round change timeout of Istanbul BFT consensus algorithm?

I have a security-related question regarding the exponentially increasing timeout in the round change, which is used in the Istanbul Byzantine fault-tolerance consensus algorithm used by Quorum. ...
0
votes
0answers
19 views

How to trace transactions to get information about hot and cold wallets?

I am researching ways how to trace transactions to get data about hot and cold wallets of exchanges, gambling sites, cantors, mixers. What sources of data could I use? What algorithms and scripts ...
0
votes
1answer
30 views

Sharing an verifiable secret message in a contract

I would like to hear your opinion on my idea to share a proof of a secret message in a contract, that users can verify later in a second phase when the message will be revealed. If the message is a ...
1
vote
2answers
26 views

How can I find out the sender's gas limit?

Is there a way to check Sender's Gas Limit? If the sender sets too low, I will just accept whatever gas amount that he had set and return immediately without hitting the limit. I am trying to ...
1
vote
2answers
40 views

Is it possible to circumvent a require statement if the ordering of the requirements are incorrect?

Please take the following hypothetical code as an example mapping (address => uint256) public accountBalance; function deposit(uint256 amount) public { accountBalance[msg.sender] = ...
1
vote
1answer
33 views

How does this function potentially violates the Checks-Effects-Interaction pattern?

I am developing a smart contract that integrates with the DAI stable coin. In the function below, you can see that I have followed the check effects interaction pattern, so how come I still get a ...
0
votes
2answers
52 views

How to fight against a cheating node?

As far as I know, there are roughly two kinds of contract calls on Ethereum. One kind is intended to change the global state of blockchain (i.e. change some storage values or transfer money). The ...
1
vote
1answer
42 views

Is it safe to do multiple payments in between locks (Reentrancy Guard)?

https://diligence.consensys.net/blog/2019/09/stop-using-soliditys-transfer-now/ provides a simple example related to using a Reentrancy Guard. Another approach to preventing reentrancy is to ...
3
votes
1answer
385 views

What's the vulnerability in my contract?

I've got a contract deployed at 0xe559835D7979dAe994331DEfaEc2FBA057E56C27 on the mainnet. Every time I go to call the payable function, which is solve, a bot beats me to it. My transaction gets ...
1
vote
1answer
27 views

private key vs seed

I made an extra account in Metamask for my GF, I kept Account 1 for myself and I gave only the private key of Account 2 to my GF. I kept the seed words only to myself. Since then, she has dumped me ...
1
vote
1answer
24 views

Is it considered secure at all to use passwords and private keys in the code of smart contract?

Basically something like: function transfer(address to, string privkey) { if(privkey == "cd33434343...") { msg.sender.transfer(this.balance); } } The above is obviously flawed since the privkey is ...
0
votes
1answer
22 views

Is function like this one reentrant?

Got this in pseudo-code (Solidity like...) from audit of past work of person from our company, in short it seems to be withdrawing first and adding later. Maybe not a good idea, especially since it's ...
1
vote
0answers
17 views

How dangerous is this: number of contracts contain a function like “approveandcall” which lets anyone call any contract (some thoughts?)

The most common implementation is as follows: function approveAndCall(address _spender, uint256 _value, bytes _extraData) public returns (bool success) { tokenRecipient spender = tokenRecipient(...
2
votes
2answers
41 views

Revert()/throw/invalid are so powerful they can even put back an already self-destructed contract, but is there a way to surpass such limitation?

I know this sounds confusing so let me explain: In this case below a transaction will succeed and a contract will be first destroyed and then re-initialized on the same address (yes, I didn't think ...
1
vote
1answer
25 views

Are simultanous transactions possible (basic but potentially very dangerous security concern…most likely impossible…)?

Long story short I am curious how a contract stores variables in memory, so is it possible to spam say 100 transactions at once and the values to be changed afterwards...I am sure I am giving bad ...
1
vote
1answer
35 views

How are transfer and send protecting against reentrancy if the gas is taken from the EOA (msg.sender)?

I guess transfer and send simply allow 2300 gas but no gas is taken from the contract? In other words if a wallet calls this function with say one million wei gas: function sending() public payable { ...
2
votes
1answer
27 views

How dangerous is to use tx.origin to check if msg.sender is some address? (details below…)

Let's say: function transfer() public payable { require(tx.origin == 0xb2930B35844a230f00E51431aCAe96Fe543a0347); msg.sender.call.value(1 ether)(); } Ignore the address above I just copied it ...
0
votes
0answers
14 views

Is function like that prone to reentrancy?

function transfer() payable public returns(bool) { balances[msg.sender] = SafeMath.sub(balances[msg.sender], msg.value); if(msg.sender.call.gas(100000).value(msg.value)()) { ...
5
votes
1answer
375 views

Is transfer() still safe after the Istanbul update?

In other words, is using transfer() safe? function transfer(address contractB) public { contractB.transfer(1000); //balances[msg.sender] -= 1000; } How about using call.gas? function ...
0
votes
1answer
31 views

Is there a case in which selfdestruct is more “powerful” than throw or revert?

Example in this scenario I guess selfdestruct will never get called (also: contract A isn't so important by the way just focus on B onward): in Contract A: address contractb = 0x....; function ...
0
votes
1answer
16 views

Can you change a variable outside of a function (assuming this variable may be a constant)?

In other words if a contract looks like this: contract tokenX { bool public started = true; function end() { started = false; } } So everyone should be able to call end() but can someone call "...
0
votes
1answer
33 views

Alternate to Allowing Insecure Unlock

Several places say insecure unlock is poor practice. Yet this module I am learning implements it. Where can I find a way to Deploy an account without insecure unlock Here is repository with files I ...
0
votes
0answers
50 views

Unable to Unlock Account Even After specifying allow-insecure-unlock

Software: Ubuntu on VirtualBox Update, tried putting two dashes, on allow-insecure-unlock, doesn't work solidity@solidity:~$ geth attach http://127.0.0.1:8545 --allow-insecure-unlock Incorrect Usage:...
0
votes
0answers
16 views

Problem with understanding the solution for Transaction Ordeing Vulnerability

For the following paper, I can’t understand the text written below: https://arxiv.org/pdf/1806.01143.pdf Our violation pattern checks that the amount of the call instruction is determined by a ...
0
votes
0answers
15 views

Backward program analysis (like symbolic backward execution) tools for smart contracts

I know there are some backward program analysis tools for traditional softwares, but i wonder if there are already backward symbolic execution tools for smart contracts, or any tool that I can refer ...
0
votes
1answer
37 views

ERC20 vulnerability? Executing transferFrom undesirably

Say I have a contract called MyContract, and I require to send 100000 DAI to it. Ideally, I'd firstly call approve(<address of A>, 100000e18) in DAI's contract itself. Secondly, I'd execute, for ...
0
votes
1answer
34 views

How dangerous the 'short address' attack is as of 2019, October and what ways there are to mitigate it?

From what I read there's a well public knowledge of reantrancy and underflows/overflows due to the cases of documented hacks and stolen ether - yet the short address attack seems less known. I know in ...
0
votes
2answers
34 views

Is there a way to create double-spending transactions and submit them to different nodes?

I'm trying to create two transactions with the same nonce and send those transactions to two different nodes. Such as: const Web3 = require('web3'); const web3_1 = new Web3(rpcURL1); // node 1 const ...
0
votes
1answer
40 views

How to build security into Dapps?

I am building a loan dapp. The functionality is not easy to build but relatively straightforward. My question is though does anyone have any suggestions of how to build in user logins and security? ...
0
votes
0answers
17 views

Hidding IP address behind sentry nodes

I would like to know how to set up an Ethereum node behind sentries (proxy nodes). I know there are several ways to approach this issue as mentioned here. https://medium.com/@kidinamoto/tech-choices-...
0
votes
1answer
15 views

Can a miner delay a transaction?

Say that my wallet is connected to a malicious miner. Of course this miner can DoS me and ignore all my transactions, but can they withhold it and release it to the network in the future? Or is the ...
0
votes
0answers
29 views

Can you verify transaction data by matching it to the transaction hash

TlDr; Can you use the transaction hash to confirm the integrity of the data components of a transaction (post data, addresses, nonce, etc). In my application, I have a connection to the Ethereum ...
0
votes
1answer
37 views

dApp design and security question

I'm designing a dApp where users can submit work they've done (files) to ipfs/swarm. To get credit for the work they then reference the hash of the files when calling a smart contract. What are some ...
1
vote
0answers
27 views

Is there a curated list of known security vulnerabilities related to escrow?

In Factories Improve Smart Contract Security, Steve Marx says that: This bug was hand-picked to show the benefit, but this bug is representative of a large class of bugs around escrow. In my ...
4
votes
1answer
42 views

Why is the subcall gas limit set to 63/64th of the remaining gas?

From the solidity docs: Calls are limited to a depth of 1024, which means that for more complex operations, loops should be preferred over recursive calls. Furthermore, only 63/64th of the gas can ...
1
vote
1answer
25 views

Why OpenZepplin always use private visibility for state variables?

Why OpenZepplin always use private visibility with getter functions for its state variables? I can't find a reason why they are not using public, is there any potential security or gas cost difference ...
0
votes
1answer
34 views

Gas optimisation for my art experiment spacecans.com

so I was microdosing some research chems and the thought came to me that I need to do some artsy blockchain stuff for once. It's two tin cans floating in space that you can advertise your so-called ...
2
votes
1answer
36 views

Getter functions for loop security

Is there any security issue when making for-loops inside getter functions ? Let's say the array is very large, and it takes a long time to loop through the array. Is it a potential threat or I can ...
1
vote
0answers
37 views

Help hacking this contract

This is a very simple contract that I can't hack and I'm stuck, I need some help to get the concepts right. pragma solidity ^0.4.10; contract SimpleToken { mapping(address => uint) public ...
0
votes
1answer
23 views

Risk of Messages Not Having a Signature

As per my understanding transactions are signed before sending to Ethereum. Else, no transfer of Ether will happen. However, messages sent to Smart Contracts (SC) aren't signed (e.g., using methods....
1
vote
1answer
56 views

How mining happen in private and permissioned blockchain?

In public blockchain a miner gets rewarded for mining a block. But in a private or permissioned blockchain, if there are no rewarding facilities available, how does the mining happen? Also, is it ...
0
votes
1answer
25 views

Is it safe to share my signed transaction publicly?

If someone got hold of my Ethereum signed transaction, is my wallet still safe? Can they extract the raw transaction from the signed transaction to get my private key?
0
votes
1answer
107 views

Solidity: extract data from signed message?

In an effort to reduce gas costs for users, I'm looking for a way to delegate certain transactions to a contract owner so that the owner makes a transactions that would have been otherwise sent by the ...
1
vote
1answer
52 views

Off-chain authorization system

I'm working on a dapp and am running into a dilemma regarding how to balance trustlessness with the cost of transactions for users. In order to reduce gas usage by users, I want to be able to able to ...
1
vote
0answers
14 views

How exactly theᴅᴀᴏ reentrancy hack was performed without having weiGiven>0 nor IsAllowed(WithdrawAddress)?

The well known ᴅᴀᴏ hack didn’t affect ether balances of theᴅᴀᴏ but balances of rewardAccount. That’s why I’m talking about the hack version which affected contract balances of theᴅᴀᴏ itself. With ...
1
vote
1answer
26 views

Is it possible to manipulate maximum callstack size in solidity?

I'm a student learning about solidity language. According to solidity's official docs, the maximum callstack size is 1024. But, I am wondering, can a developer change the maximum callstack size in ...

1 2 3 4 5 11