Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

108 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3
votes
0answers
41 views

What are best practices for monitoring the OpenEthereum (Parity) logging?

Monitoring of the logging output of the Ethereum clients is essential for stable blockchain operation. Do you have recommendations, experiences and/or lessons learned concerning the logging of ...
3
votes
1answer
56 views

What are the drawbacks of layer 2?

The scalability trilemma states that a blockchain can only have two out the following three properties: decentralization, scalability, and security. Layer 2 protocols aim to make Ethereum more ...
3
votes
0answers
76 views

Storing Private Keys in IoT Devices

In a network of IoT devices like internet-connected Raspberry Pis which sends transactions to the Ethereum blockchain, the Pis need to be able to access their own Ethereum private keys in order to ...
3
votes
0answers
120 views

Parity create testing transactions and blocks

For test purposes, I would like to make test blocks including test transactions against main net. For example I would like to make a transaction that sends one ether from 0x1234567... to 0x99999999......
3
votes
0answers
1k views

Is this approach to an ethereum lottery sound and/or novel?

I'm looking at making gambling apps is ethereum. Currently made a contract that can flip a coin. After looking at this question: How can I securely generate a random number in my smart contract? and ...
3
votes
0answers
90 views

What is an empty account if the state root is not empty?

"State-bloat" attacks led to an empty account being defined as an account that has zero balance, nonce and code. There was a disagreement on EIP 161: I disagree. An account should be considered ...
3
votes
0answers
243 views

What's reverted and not reverted during an Out of Gas exception?

A seemingly crucial question on EIP 158 was unanswered: Unless the empty accounts are deleted even in the case of an EVM exception, if that is the case would that not break the guarantee that ...
2
votes
1answer
27 views

Can you potentially mine for anything?

This is more of a general "blockchain" question and not specific to Ethereum so if I'm off topic here I would appreciate it if you could direct me to a more relevant stackexchange maybe. On ...
2
votes
0answers
60 views

Even if I own 51% of stake (or have 51% computational power) and try to cheat, can't others still see that my block is invalid?

I'm thinking about how proof of stake works exactly. As I understand, here is how it is secure: I cannot forge a tx where random A pays me X amount because I would need the private keys of A. ...
2
votes
0answers
791 views

Frontrunning Uniswap horror story transactions

From the Ethereum is a Dark Forest post, the rescue plan was: Deploy a Getter contract which, when called by its owner, would make the burn call ONLY if activated, and otherwise revert. Deploy a ...
2
votes
1answer
137 views

The blockchain trilemma

I understand that the generic blockchain faces a problem where it can choose to optimize between scalability, security and decentralization. I can see easily why scalability and decentralization are ...
2
votes
1answer
63 views

In the case the Zerofunctionselector bug, how to know which function NAME has a 0 selector?

Normally, If a smart contract is not affected by the Zerofunctionselector bug, then at the end of the code which makes jump to the target function lies a 0xfe opcode (which result in the smart ...
2
votes
0answers
68 views

What would be the steps required to entirely derive an address with pen and paper?

I'd like to see the steps required to derive an address by hand, with pen and paper, along with an estimate of time required. Is it feasible to derive an address entirely with pen and paper? What ...
2
votes
0answers
211 views

Why does the new light-client example throw a warning?

Even though I use the new example, lightwallet throws me: The new KeyStore constructor has been deprecated in favor of KeyStore.createVault(), and will be removed in a future version. Read issue #...
2
votes
0answers
129 views

How many people were involved in auditing the DAO code? And how many Eth code auditors are there we can goto?

How many were responsible for auditing the DAO code? It's understandable that bugs arise from any type of code, but having that the DAO was a big project and that once its created it shouldn't be ...
1
vote
1answer
52 views

Hacked Ethereum wallet — What do do with staked tokens?

My MetaMask wallet was unfortunately hacked and the hacker drained all of my tokens. I've sent some test tokens back to the wallet to check if the hacker had installed a smart contract to ...
1
vote
0answers
57 views

Safe implementation on Solidity 0.8.0 of a withdrawal and a refund

I'm here for asking of a SECURE way to implement on solidity 0.8.0 two functions: 1-Withdrawal() which sends all the ether of the smart contract to the owner address. My current implementation is: //...
1
vote
0answers
24 views

eip-1967 address calculation

I have read EIP-1967 and i have study how work proxy contracts. There is something i do not understand in EIP-1967. Here is what i have understood: Logic contract's storage variables are stored in ...
1
vote
1answer
175 views

How are Metamask web wallets traceable to owner identity?

When creating a Metamask wallet as a Chrome browser extension, what are all the different identifiers that match the wallet to its owner? Since it takes a password to log into the Metamask wallet, ...
1
vote
0answers
67 views

What s the fake deposit attack affecting some exchanges with erc20?

There are a lot of articles about hacked tokens affecting centralized exchanges only when Googling fake erc20 deposit but I failed to find a reference describing how the attack works technically. The ...
1
vote
0answers
86 views

Flash minting ether security considerations and attacks

Flash loans enable a class of attacks that have not been possible or observed as much in prior systems. Flash minting ether is a concept that is starting to be implemented. See Example of flash ...
1
vote
0answers
24 views

Is there any free-to-use scenario builder?

The Compound Protocol has a collection of high-level integration tests, dubbed "scenarios": https://github.com/compound-finance/compound-protocol/tree/v2.8.1/spec Which look like this: Test &...
1
vote
0answers
19 views

Cost of forking Augur

Augur Version 2 is scheduled for launch on July 28th 2020. How can the cost of forking Augur version 2 (by disputing a market resolution) be calculated in REP? How dies this cost compare to the cost ...
1
vote
0answers
120 views

How does MetaMask secure / store unlocked accounts?

I understand that MetaMask stores the encrypted vault somewhere like C:\Users\USER_NAME\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn ...
1
vote
1answer
31 views

State only node

Is it possible for the network clients to just keep the latest network state (without keeping track of the past transactions) while not harming the network security? That is, is it really needed to ...
1
vote
0answers
162 views

Sending secure transactions using web3.py

An ethereum account I had has been hacked, where whenever I send it, say, 0.1 eth, some evil bot immediately sends 0.0009 eth from that account to a dummy account, and then spends the remaining 0.0991 ...
1
vote
1answer
85 views

How does this function potentially violates the Checks-Effects-Interaction pattern?

I am developing a smart contract that integrates with the DAI stable coin. In the function below, you can see that I have followed the check effects interaction pattern, so how come I still get a ...
1
vote
0answers
35 views

How dangerous is this: number of contracts contain a function like “approveandcall” which lets anyone call any contract (some thoughts?)

The most common implementation is as follows: function approveAndCall(address _spender, uint256 _value, bytes _extraData) public returns (bool success) { tokenRecipient spender = tokenRecipient(...
1
vote
0answers
30 views

Is there a curated list of known security vulnerabilities related to escrow?

In Factories Improve Smart Contract Security, Steve Marx says that: This bug was hand-picked to show the benefit, but this bug is representative of a large class of bugs around escrow. In my ...
1
vote
0answers
41 views

Help hacking this contract

This is a very simple contract that I can't hack and I'm stuck, I need some help to get the concepts right. pragma solidity ^0.4.10; contract SimpleToken { mapping(address => uint) public ...
1
vote
1answer
53 views

Risk of Messages Not Having a Signature

As per my understanding transactions are signed before sending to Ethereum. Else, no transfer of Ether will happen. However, messages sent to Smart Contracts (SC) aren't signed (e.g., using methods....
1
vote
0answers
21 views

How exactly theᴅᴀᴏ reentrancy hack was performed without having weiGiven>0 nor IsAllowed(WithdrawAddress)?

The well known ᴅᴀᴏ hack didn’t affect ether balances of theᴅᴀᴏ but balances of rewardAccount. That’s why I’m talking about the hack version which affected contract balances of theᴅᴀᴏ itself. With ...
1
vote
1answer
64 views

adaptive vs. non-adaptive adversaries? Is there a precise, unique and general definition? (Updated)

In this Ethereum github page (Link to the page: https://github.com/ethereum/wiki/wiki/Sharding-FAQ#what-are-the-security-models-that-we-are-operating-under) there is a very brief definition of the ...
1
vote
1answer
84 views

Proxy function clashing - what kind of danger comes exactly with it?

I read that if I am using proxy, there is a chance of function clashing. Let's say in my contract there is a function with a signature: proxyOwner() ...
1
vote
0answers
18 views

Understanding a simple online contract which seems not functional

I am writing to understand the functionality of this contract (https://etherscan.io/address/0x1f14b77e9f4844889fa63bc1e5180c8b90ec18db), this does not look even "functional" to me. Here is the ...
1
vote
3answers
270 views

How to prevent frontrunning: someone running a transaction before me?

Let's say I have the following in my smart contract: string passwordHash; uint money; function checkPassword(string cleanPassword, string newPasswordHash)[...] When running the function ...
1
vote
0answers
62 views

Is there a more elegant way to do an aggressive multi-send?

I understand there are many approaches to do multisend but for me timing is a priority and I do not want to stop the transaction if a address.send fails. function multiSend() internal isAdmin { ...
1
vote
0answers
41 views

GETH accounts imported without my knowledge

I expose only port 30303, not 8545. But when I issue commands eth.accounts. I found these accounts were imported without my knowledge: "0xe4fe1fb7e693c529f5a95dd8b1714d1acfdbd058", "...
1
vote
1answer
72 views

Access manager in Smart Contract

I'm building a service where one can publish a crypted file on the internet which can be accessed and decrypted by people allowed. I don't want to store any crypted key on a server or something. For ...
1
vote
0answers
48 views

MIME types in Ethereum

Yesterday evening, an individual(at a french meetup haha) asked me what ethereum was and kept asking me if there was something similar to MIME types on Ethereum. I did not know what MIME types were ...
1
vote
1answer
238 views

Using Hardware Security Modules to generate and store private keys on private ethereum / quorum

For a private ethereum networks, has anyone used Hardware Security Modules (HSM) to generate and store Ethereum private keys? I am keen to know how public/private keys are managed without a PKI (...
1
vote
0answers
119 views

Unlock account on Ethereum client, or sign every transaction sent it to Ethereum client?

I have a contract which needs to be updated occasionally. For this purpose, I set up an Ethereum client, namely, a Parity node. At this point, I see several ways of carrying out the specified task: ...
1
vote
0answers
25 views

security and implementation challanges when launching the token

I would like to know what are security holes when launching an ERC20 token or other tokens. Below is my process of launching token: Creates an ERC20 token contract with truffle. Defines network ...
1
vote
2answers
601 views

Automatic transaction

I would like to know if it was possible to automatically send any ETH amout to an address "B" just after receiving them on an address "A"? Maybe via a script? I need help
1
vote
2answers
62 views

Dos with revert

While I was reading a guide on smart contract security (by consensys) I found this: // INSECURE contract Auction { address currentLeader; uint highestBid; function bid() payable { ...
1
vote
0answers
33 views

Are API tokens incompatible with Ethereum apps?

I want to build an Ethereum app that gets weather data from a trusted (government run) API via oracilize. This service requires an API token to be sent with each request to prevent abuse. Each API ...
1
vote
0answers
30 views

Build blockchain application that has some off-chain functionalities

I am learning about blockchain and I have a general question. Let's say that I want to build my custom blockchain based on Ethereum. My implementation has many nodes and few of them are chosen ...
1
vote
0answers
357 views

Is it safe to use web3.eth.accounts.create() in frontend?

web3.eth.accounts.create returns the address along with private key so I was wondering if is it safe to call it using plain JS in website frontend instead of doing it server side in Node? My use case ...
1
vote
0answers
53 views

How to limit transactions to only approve addresses?

I am dealing with a private consortium scenario (private Ethereum network) where all participants are known in advance and have assigned an addresses used in genesis. Like to know if its possible to ...
1
vote
0answers
112 views

Tracking transaction attempts/failed attempts sent to a contract from unknown parties

In light of the recently killed parity library and how the person responsible went around randomly trying to kill contracts, is there a way of monitoring smart contracts for attempted and potentially ...