Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

93 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3
votes
1answer
44 views

What are the drawbacks of layer 2?

The scalability trilemma states that a blockchain can only have two out the following three properties: decentralization, scalability, and security. Layer 2 protocols aim to make Ethereum more ...
3
votes
0answers
73 views

Storing Private Keys in IoT Devices

In a network of IoT devices like internet-connected Raspberry Pis which sends transactions to the Ethereum blockchain, the Pis need to be able to access their own Ethereum private keys in order to ...
3
votes
0answers
113 views

Parity create testing transactions and blocks

For test purposes, I would like to make test blocks including test transactions against main net. For example I would like to make a transaction that sends one ether from 0x1234567... to 0x99999999......
3
votes
0answers
1k views

Is this approach to an ethereum lottery sound and/or novel?

I'm looking at making gambling apps is ethereum. Currently made a contract that can flip a coin. After looking at this question: How can I securely generate a random number in my smart contract? and ...
3
votes
0answers
89 views

What is an empty account if the state root is not empty?

"State-bloat" attacks led to an empty account being defined as an account that has zero balance, nonce and code. There was a disagreement on EIP 161: I disagree. An account should be considered ...
3
votes
0answers
215 views

What's reverted and not reverted during an Out of Gas exception?

A seemingly crucial question on EIP 158 was unanswered: Unless the empty accounts are deleted even in the case of an EVM exception, if that is the case would that not break the guarantee that ...
2
votes
0answers
316 views

Frontrunning Uniswap horror story transactions

From the Ethereum is a Dark Forest post, the rescue plan was: Deploy a Getter contract which, when called by its owner, would make the burn call ONLY if activated, and otherwise revert. Deploy a ...
2
votes
1answer
86 views

The blockchain trilemma

I understand that the generic blockchain faces a problem where it can choose to optimize between scalability, security and decentralization. I can see easily why scalability and decentralization are ...
2
votes
1answer
62 views

In the case the Zerofunctionselector bug, how to know which function NAME has a 0 selector?

Normally, If a smart contract is not affected by the Zerofunctionselector bug, then at the end of the code which makes jump to the target function lies a 0xfe opcode (which result in the smart ...
2
votes
0answers
67 views

What would be the steps required to entirely derive an address with pen and paper?

I'd like to see the steps required to derive an address by hand, with pen and paper, along with an estimate of time required. Is it feasible to derive an address entirely with pen and paper? What ...
2
votes
0answers
210 views

Why does the new light-client example throw a warning?

Even though I use the new example, lightwallet throws me: The new KeyStore constructor has been deprecated in favor of KeyStore.createVault(), and will be removed in a future version. Read issue #...
2
votes
0answers
126 views

How many people were involved in auditing the DAO code? And how many Eth code auditors are there we can goto?

How many were responsible for auditing the DAO code? It's understandable that bugs arise from any type of code, but having that the DAO was a big project and that once its created it shouldn't be ...
1
vote
0answers
26 views

What s the fake deposit attack affecting some exchanges with erc20?

There are a lot of articles about hacked tokens affecting centralized exchanges only when Googling fake erc20 deposit but I failed to find a reference describing how the attack works technically. The ...
1
vote
0answers
47 views

Flash minting ether security considerations and attacks

Flash loans enable a class of attacks that have not been possible or observed as much in prior systems. Flash minting ether is a concept that is starting to be implemented. See Example of flash ...
1
vote
0answers
19 views

Is there any free-to-use scenario builder?

The Compound Protocol has a collection of high-level integration tests, dubbed "scenarios": https://github.com/compound-finance/compound-protocol/tree/v2.8.1/spec Which look like this: Test &...
1
vote
0answers
18 views

Difference between SMTChecker and Manticore?

Why would I use Trail of Bits' Manticore over SMTChecker, which is baked in the Solidity compiler?
1
vote
0answers
18 views

Cost of forking Augur

Augur Version 2 is scheduled for launch on July 28th 2020. How can the cost of forking Augur version 2 (by disputing a market resolution) be calculated in REP? How dies this cost compare to the cost ...
1
vote
0answers
55 views

How does MetaMask secure / store unlocked accounts?

I understand that MetaMask stores the encrypted vault somewhere like C:\Users\USER_NAME\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn ...
1
vote
1answer
29 views

State only node

Is it possible for the network clients to just keep the latest network state (without keeping track of the past transactions) while not harming the network security? That is, is it really needed to ...
1
vote
0answers
98 views

Sending secure transactions using web3.py

An ethereum account I had has been hacked, where whenever I send it, say, 0.1 eth, some evil bot immediately sends 0.0009 eth from that account to a dummy account, and then spends the remaining 0.0991 ...
1
vote
1answer
61 views

How does this function potentially violates the Checks-Effects-Interaction pattern?

I am developing a smart contract that integrates with the DAI stable coin. In the function below, you can see that I have followed the check effects interaction pattern, so how come I still get a ...
1
vote
0answers
31 views

How dangerous is this: number of contracts contain a function like “approveandcall” which lets anyone call any contract (some thoughts?)

The most common implementation is as follows: function approveAndCall(address _spender, uint256 _value, bytes _extraData) public returns (bool success) { tokenRecipient spender = tokenRecipient(...
1
vote
0answers
30 views

Is there a curated list of known security vulnerabilities related to escrow?

In Factories Improve Smart Contract Security, Steve Marx says that: This bug was hand-picked to show the benefit, but this bug is representative of a large class of bugs around escrow. In my ...
1
vote
0answers
40 views

Help hacking this contract

This is a very simple contract that I can't hack and I'm stuck, I need some help to get the concepts right. pragma solidity ^0.4.10; contract SimpleToken { mapping(address => uint) public ...
1
vote
1answer
41 views

Risk of Messages Not Having a Signature

As per my understanding transactions are signed before sending to Ethereum. Else, no transfer of Ether will happen. However, messages sent to Smart Contracts (SC) aren't signed (e.g., using methods....
1
vote
0answers
20 views

How exactly theᴅᴀᴏ reentrancy hack was performed without having weiGiven>0 nor IsAllowed(WithdrawAddress)?

The well known ᴅᴀᴏ hack didn’t affect ether balances of theᴅᴀᴏ but balances of rewardAccount. That’s why I’m talking about the hack version which affected contract balances of theᴅᴀᴏ itself. With ...
1
vote
1answer
60 views

adaptive vs. non-adaptive adversaries? Is there a precise, unique and general definition? (Updated)

In this Ethereum github page (Link to the page: https://github.com/ethereum/wiki/wiki/Sharding-FAQ#what-are-the-security-models-that-we-are-operating-under) there is a very brief definition of the ...
1
vote
0answers
17 views

Understanding a simple online contract which seems not functional

I am writing to understand the functionality of this contract (https://etherscan.io/address/0x1f14b77e9f4844889fa63bc1e5180c8b90ec18db), this does not look even "functional" to me. Here is the ...
1
vote
3answers
78 views

How to prevent frontrunning: someone running a transaction before me?

Let's say I have the following in my smart contract: string passwordHash; uint money; function checkPassword(string cleanPassword, string newPasswordHash)[...] When running the function ...
1
vote
0answers
58 views

Is there a more elegant way to do an aggressive multi-send?

I understand there are many approaches to do multisend but for me timing is a priority and I do not want to stop the transaction if a address.send fails. function multiSend() internal isAdmin { ...
1
vote
0answers
41 views

GETH accounts imported without my knowledge

I expose only port 30303, not 8545. But when I issue commands eth.accounts. I found these accounts were imported without my knowledge: "0xe4fe1fb7e693c529f5a95dd8b1714d1acfdbd058", "...
1
vote
1answer
71 views

Access manager in Smart Contract

I'm building a service where one can publish a crypted file on the internet which can be accessed and decrypted by people allowed. I don't want to store any crypted key on a server or something. For ...
1
vote
0answers
42 views

MIME types in Ethereum

Yesterday evening, an individual(at a french meetup haha) asked me what ethereum was and kept asking me if there was something similar to MIME types on Ethereum. I did not know what MIME types were ...
1
vote
1answer
228 views

Using Hardware Security Modules to generate and store private keys on private ethereum / quorum

For a private ethereum networks, has anyone used Hardware Security Modules (HSM) to generate and store Ethereum private keys? I am keen to know how public/private keys are managed without a PKI (...
1
vote
0answers
115 views

Unlock account on Ethereum client, or sign every transaction sent it to Ethereum client?

I have a contract which needs to be updated occasionally. For this purpose, I set up an Ethereum client, namely, a Parity node. At this point, I see several ways of carrying out the specified task: ...
1
vote
0answers
25 views

security and implementation challanges when launching the token

I would like to know what are security holes when launching an ERC20 token or other tokens. Below is my process of launching token: Creates an ERC20 token contract with truffle. Defines network ...
1
vote
2answers
533 views

Automatic transaction

I would like to know if it was possible to automatically send any ETH amout to an address "B" just after receiving them on an address "A"? Maybe via a script? I need help
1
vote
2answers
58 views

Dos with revert

While I was reading a guide on smart contract security (by consensys) I found this: // INSECURE contract Auction { address currentLeader; uint highestBid; function bid() payable { ...
1
vote
0answers
33 views

Are API tokens incompatible with Ethereum apps?

I want to build an Ethereum app that gets weather data from a trusted (government run) API via oracilize. This service requires an API token to be sent with each request to prevent abuse. Each API ...
1
vote
0answers
29 views

Build blockchain application that has some off-chain functionalities

I am learning about blockchain and I have a general question. Let's say that I want to build my custom blockchain based on Ethereum. My implementation has many nodes and few of them are chosen ...
1
vote
0answers
345 views

Is it safe to use web3.eth.accounts.create() in frontend?

web3.eth.accounts.create returns the address along with private key so I was wondering if is it safe to call it using plain JS in website frontend instead of doing it server side in Node? My use case ...
1
vote
0answers
51 views

How to limit transactions to only approve addresses?

I am dealing with a private consortium scenario (private Ethereum network) where all participants are known in advance and have assigned an addresses used in genesis. Like to know if its possible to ...
1
vote
0answers
110 views

Tracking transaction attempts/failed attempts sent to a contract from unknown parties

In light of the recently killed parity library and how the person responsible went around randomly trying to kill contracts, is there a way of monitoring smart contracts for attempted and potentially ...
1
vote
0answers
421 views

How do I backup my wallet

I'm using the Ethereum Wallet. When I click - File > Backup > Accounts, it does nothing. Can't see the UTC keystore files in AppData\Roaming\Ethereum Wallet What am I doing wrong? I have 1 ...
1
vote
0answers
95 views

Solidity — refactor simple contracts to fix gas limit and avoid Checks-Effects-Interaction warning

The following pattern is something that recurs a lot in the contracts I am develping and when I run an analyser over it I get a couple of warning. Say I have two contracts as follows: pragma ...
1
vote
0answers
305 views

Build secure private ethereum blockchain with geth!

I have read on the StackExchange how to build a private blockchain in LAN with private IPs and geth clients. As I understood to communicate in lan the geth peers need for P2P communication the form ...
1
vote
0answers
295 views

Abstraction and ACL in a smart contract

I have two smart contracts, say Admin and Subject. For this purpose lets assume that ten unique accounts have deployed 10 such Admin contracts. One Subject contract has been deployed which has a ...
1
vote
0answers
270 views

How is transaction finality correlated with transacted amount?

It was argued by Vitalik Buterin that transaction security can be a function of the amount the transaction carries. This is because of the economics of attacks. How many block confirmations would you ...
0
votes
1answer
12 views

The security of private key with geth on the server-side

If you initiate a transaction in real time, you need to store the private key on the geth server to initiate the transaction. Once the geth server is hacked, the private key may be leaked. Is there ...
0
votes
0answers
20 views

the security of nodes in private chain

I implemented a private chain, and now there are some nodes on the chain. I want to use these nodes to call a smart contract to vote. My question now is how to ensure the security of the nodes on ...