Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

76 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3
votes
0answers
62 views

Storing Private Keys in IoT Devices

In a network of IoT devices like internet-connected Raspberry Pis which sends transactions to the Ethereum blockchain, the Pis need to be able to access their own Ethereum private keys in order to ...
3
votes
0answers
104 views

Parity create testing transactions and blocks

For test purposes, I would like to make test blocks including test transactions against main net. For example I would like to make a transaction that sends one ether from 0x1234567... to 0x99999999......
3
votes
0answers
1k views

Is this approach to an ethereum lottery sound and/or novel?

I'm looking at making gambling apps is ethereum. Currently made a contract that can flip a coin. After looking at this question: How can I securely generate a random number in my smart contract? and ...
3
votes
0answers
181 views

What's reverted and not reverted during an Out of Gas exception?

A seemingly crucial question on EIP 158 was unanswered: Unless the empty accounts are deleted even in the case of an EVM exception, if that is the case would that not break the guarantee that ...
2
votes
0answers
65 views

What would be the steps required to entirely derive an address with pen and paper?

I'd like to see the steps required to derive an address by hand, with pen and paper, along with an estimate of time required. Is it feasible to derive an address entirely with pen and paper? What ...
2
votes
0answers
80 views

What is an empty account if the state root is not empty?

"State-bloat" attacks led to an empty account being defined as an account that has zero balance, nonce and code. There was a disagreement on EIP 161: I disagree. An account should be considered ...
2
votes
0answers
203 views

Why does the new light-client example throw a warning?

Even though I use the new example, lightwallet throws me: The new KeyStore constructor has been deprecated in favor of KeyStore.createVault(), and will be removed in a future version. Read issue #...
2
votes
0answers
120 views

How many people were involved in auditing the DAO code? And how many Eth code auditors are there we can goto?

How many were responsible for auditing the DAO code? It's understandable that bugs arise from any type of code, but having that the DAO was a big project and that once its created it shouldn't be ...
1
vote
1answer
32 views

How does this function potentially violates the Checks-Effects-Interaction pattern?

I am developing a smart contract that integrates with the DAI stable coin. In the function below, you can see that I have followed the check effects interaction pattern, so how come I still get a ...
1
vote
0answers
16 views

How dangerous is this: number of contracts contain a function like “approveandcall” which lets anyone call any contract (some thoughts?)

The most common implementation is as follows: function approveAndCall(address _spender, uint256 _value, bytes _extraData) public returns (bool success) { tokenRecipient spender = tokenRecipient(...
1
vote
0answers
27 views

Is there a curated list of known security vulnerabilities related to escrow?

In Factories Improve Smart Contract Security, Steve Marx says that: This bug was hand-picked to show the benefit, but this bug is representative of a large class of bugs around escrow. In my ...
1
vote
0answers
37 views

Help hacking this contract

This is a very simple contract that I can't hack and I'm stuck, I need some help to get the concepts right. pragma solidity ^0.4.10; contract SimpleToken { mapping(address => uint) public ...
1
vote
0answers
14 views

How exactly theᴅᴀᴏ reentrancy hack was performed without having weiGiven>0 nor IsAllowed(WithdrawAddress)?

The well known ᴅᴀᴏ hack didn’t affect ether balances of theᴅᴀᴏ but balances of rewardAccount. That’s why I’m talking about the hack version which affected contract balances of theᴅᴀᴏ itself. With ...
1
vote
1answer
41 views

adaptive vs. non-adaptive adversaries? Is there a precise, unique and general definition? (Updated)

In this Ethereum github page (Link to the page: https://github.com/ethereum/wiki/wiki/Sharding-FAQ#what-are-the-security-models-that-we-are-operating-under) there is a very brief definition of the ...
1
vote
0answers
15 views

Understanding a simple online contract which seems not functional

I am writing to understand the functionality of this contract (https://etherscan.io/address/0x1f14b77e9f4844889fa63bc1e5180c8b90ec18db), this does not look even "functional" to me. Here is the ...
1
vote
0answers
29 views

What are the drawbacks of layer 2?

The scalability trilemma states that a blockchain can only have two out the following three properties: decentralization, scalability, and security. Layer 2 protocols aim to make Ethereum more ...
1
vote
0answers
63 views

The blockchain trilemma

I understand that the generic blockchain faces a problem where it can choose to optimize between scalability, security and decentralization. I can see easily why scalability and decentralization are ...
1
vote
0answers
44 views

Is there a more elegant way to do an aggressive multi-send?

I understand there are many approaches to do multisend but for me timing is a priority and I do not want to stop the transaction if a address.send fails. function multiSend() internal isAdmin { ...
1
vote
0answers
40 views

GETH accounts imported without my knowledge

I expose only port 30303, not 8545. But when I issue commands eth.accounts. I found these accounts were imported without my knowledge: "0xe4fe1fb7e693c529f5a95dd8b1714d1acfdbd058", "...
1
vote
1answer
64 views

Access manager in Smart Contract

I'm building a service where one can publish a crypted file on the internet which can be accessed and decrypted by people allowed. I don't want to store any crypted key on a server or something. For ...
1
vote
0answers
37 views

MIME types in Ethereum

Yesterday evening, an individual(at a french meetup haha) asked me what ethereum was and kept asking me if there was something similar to MIME types on Ethereum. I did not know what MIME types were ...
1
vote
1answer
189 views

Using Hardware Security Modules to generate and store private keys on private ethereum / quorum

For a private ethereum networks, has anyone used Hardware Security Modules (HSM) to generate and store Ethereum private keys? I am keen to know how public/private keys are managed without a PKI (...
1
vote
0answers
84 views

Unlock account on Ethereum client, or sign every transaction sent it to Ethereum client?

I have a contract which needs to be updated occasionally. For this purpose, I set up an Ethereum client, namely, a Parity node. At this point, I see several ways of carrying out the specified task: ...
1
vote
1answer
51 views

In the case the Zerofunctionselector bug, how to know which function NAME as a 0 selector?

Normally, If a smart contract is not affected by the Zerofunctionselector bug, then at the end of the code which makes jump to the target function lies a 0xfe opcode (which result in the smart ...
1
vote
0answers
24 views

security and implementation challanges when launching the token

I would like to know what are security holes when launching an ERC20 token or other tokens. Below is my process of launching token: Creates an ERC20 token contract with truffle. Defines network ...
1
vote
2answers
398 views

Automatic transaction

I would like to know if it was possible to automatically send any ETH amout to an address "B" just after receiving them on an address "A"? Maybe via a script? I need help
1
vote
2answers
37 views

Dos with revert

While I was reading a guide on smart contract security (by consensys) I found this: // INSECURE contract Auction { address currentLeader; uint highestBid; function bid() payable { ...
1
vote
0answers
32 views

Are API tokens incompatible with Ethereum apps?

I want to build an Ethereum app that gets weather data from a trusted (government run) API via oracilize. This service requires an API token to be sent with each request to prevent abuse. Each API ...
1
vote
0answers
28 views

Build blockchain application that has some off-chain functionalities

I am learning about blockchain and I have a general question. Let's say that I want to build my custom blockchain based on Ethereum. My implementation has many nodes and few of them are chosen ...
1
vote
1answer
166 views

Implication of hacking into an ethereum node on proof of stake

It is my understanding that in proof of stake, the validator puts up a stake that gets slashed if they don't respond to requests truthfully. In the scenario that someone hacks into your node, wouldn't ...
1
vote
0answers
324 views

Is it safe to use web3.eth.accounts.create() in frontend?

web3.eth.accounts.create returns the address along with private key so I was wondering if is it safe to call it using plain JS in website frontend instead of doing it server side in Node? My use case ...
1
vote
0answers
48 views

How to limit transactions to only approve addresses?

I am dealing with a private consortium scenario (private Ethereum network) where all participants are known in advance and have assigned an addresses used in genesis. Like to know if its possible to ...
1
vote
0answers
107 views

Tracking transaction attempts/failed attempts sent to a contract from unknown parties

In light of the recently killed parity library and how the person responsible went around randomly trying to kill contracts, is there a way of monitoring smart contracts for attempted and potentially ...
1
vote
0answers
410 views

How do I backup my wallet

I'm using the Ethereum Wallet. When I click - File > Backup > Accounts, it does nothing. Can't see the UTC keystore files in AppData\Roaming\Ethereum Wallet What am I doing wrong? I have 1 ...
1
vote
0answers
91 views

Solidity — refactor simple contracts to fix gas limit and avoid Checks-Effects-Interaction warning

The following pattern is something that recurs a lot in the contracts I am develping and when I run an analyser over it I get a couple of warning. Say I have two contracts as follows: pragma ...
1
vote
0answers
293 views

Build secure private ethereum blockchain with geth!

I have read on the StackExchange how to build a private blockchain in LAN with private IPs and geth clients. As I understood to communicate in lan the geth peers need for P2P communication the form ...
1
vote
0answers
281 views

Abstraction and ACL in a smart contract

I have two smart contracts, say Admin and Subject. For this purpose lets assume that ten unique accounts have deployed 10 such Admin contracts. One Subject contract has been deployed which has a ...
1
vote
0answers
268 views

How is transaction finality correlated with transacted amount?

It was argued by Vitalik Buterin that transaction security can be a function of the amount the transaction carries. This is because of the economics of attacks. How many block confirmations would you ...
0
votes
0answers
12 views

How to trace transactions to get information about hot and cold wallets?

I am researching ways how to trace transactions to get data about hot and cold wallets of exchanges, gambling sites, cantors, mixers. What sources of data could I use? What algorithms and scripts ...
0
votes
1answer
26 views

Sharing an verifiable secret message in a contract

I would like to hear your opinion on my idea to share a proof of a secret message in a contract, that users can verify later in a second phase when the message will be revealed. If the message is a ...
0
votes
0answers
14 views

Is function like that prone to reentrancy?

function transfer() payable public returns(bool) { balances[msg.sender] = SafeMath.sub(balances[msg.sender], msg.value); if(msg.sender.call.gas(100000).value(msg.value)()) { ...
0
votes
0answers
45 views

Unable to Unlock Account Even After specifying allow-insecure-unlock

Software: Ubuntu on VirtualBox Update, tried putting two dashes, on allow-insecure-unlock, doesn't work solidity@solidity:~$ geth attach http://127.0.0.1:8545 --allow-insecure-unlock Incorrect Usage:...
0
votes
0answers
16 views

Problem with understanding the solution for Transaction Ordeing Vulnerability

For the following paper, I can’t understand the text written below: https://arxiv.org/pdf/1806.01143.pdf Our violation pattern checks that the amount of the call instruction is determined by a ...
0
votes
0answers
15 views

Backward program analysis (like symbolic backward execution) tools for smart contracts

I know there are some backward program analysis tools for traditional softwares, but i wonder if there are already backward symbolic execution tools for smart contracts, or any tool that I can refer ...
0
votes
1answer
35 views

ERC20 vulnerability? Executing transferFrom undesirably

Say I have a contract called MyContract, and I require to send 100000 DAI to it. Ideally, I'd firstly call approve(<address of A>, 100000e18) in DAI's contract itself. Secondly, I'd execute, for ...
0
votes
1answer
33 views

How dangerous the 'short address' attack is as of 2019, October and what ways there are to mitigate it?

From what I read there's a well public knowledge of reantrancy and underflows/overflows due to the cases of documented hacks and stolen ether - yet the short address attack seems less known. I know in ...
0
votes
2answers
32 views

Is there a way to create double-spending transactions and submit them to different nodes?

I'm trying to create two transactions with the same nonce and send those transactions to two different nodes. Such as: const Web3 = require('web3'); const web3_1 = new Web3(rpcURL1); // node 1 const ...
0
votes
1answer
37 views

How to build security into Dapps?

I am building a loan dapp. The functionality is not easy to build but relatively straightforward. My question is though does anyone have any suggestions of how to build in user logins and security? ...
0
votes
0answers
15 views

Hidding IP address behind sentry nodes

I would like to know how to set up an Ethereum node behind sentries (proxy nodes). I know there are several ways to approach this issue as mentioned here. https://medium.com/@kidinamoto/tech-choices-...
0
votes
0answers
27 views

Can you verify transaction data by matching it to the transaction hash

TlDr; Can you use the transaction hash to confirm the integrity of the data components of a transaction (post data, addresses, nonce, etc). In my application, I have a connection to the Ethereum ...