Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
7
votes
1answer
190 views

How to get started after participating in the presale?

I participated in the Ethereum presale and have my wallet stored safely in my password manager. Then I stepped away from all things ethereum for a couple years. Now I'm ready to get back into it. I ...
2
votes
1answer
380 views

ETH vs Tokens price issue [duplicate]

Is there any possibility for one token (e.g. Augur's REP) to become more valuable than the total Ether market cap? If so, how would that be possible? In Security of PoS if/when Assets (Tracked or ...
6
votes
3answers
3k views

Is there any API for sending and receiving Ethers?

Is there any API for send and receive Ethers? If not, i am trying to use web3.js in my own server; What are the technical implications? Major security concerns? Can I use the same API for creating ...
6
votes
1answer
2k views

How does a fallback function rejecting ether work?

A contract in Solidity can have a fallback function like: // This contract rejects any Ether sent to it. It is good // practise to include such a function for every contract // in order not to loose ...
4
votes
2answers
2k views

Smallest number of nodes for an Ethereum private blockchain

In a public instance, one would expect the more miners the merrier, as this improves the overall mining diversity and therefore we get better security. Private blockchains, as in the Eris case, tend ...
11
votes
2answers
328 views

Does a light client require a chain of trust towards full nodes?

A full client does not need to trust any individual node on the Ethereum network, as the full client can see the activity from all nodes and discard any inconsistencies caused by ill intentioned nodes ...
28
votes
3answers
17k views

How can I make new account by JSON-RPC?

I'd like to make new account by JSON-RPC.I've checked the wiki of Ethereum, however I could not find out how to do that. I've found call existed accounts, but it isn't what I want. eth_accounts ...
4
votes
1answer
377 views

Why doesn't Ethereum do double hashing like Bitcoin?

Why doesn't Ethereum do double hashing like Bitcoin? What are the facts or theories on the security of single Keccak-256 hashing like Ethereum, as compared to Bitcoin's double hashing with SHA2-256? ...
22
votes
2answers
2k views

What are effective techniques to encrypt/decrypt data stored in a smart contract?

Rather than sending and storing plain text in a smart contract, the use case objective is to encrypt first and then subsequently access the data and decrypt at the point of use. What is the most ...
4
votes
1answer
1k views

How to create a “cold wallet” and is it really necessary? [duplicate]

What's up everyone. I have a decent amount of Ether and I want to protect it as much as possible. I read that basically the only way someone could hack an ETH account would be with a keylogger program....
4
votes
2answers
2k views

Unlocking accounts for a back office app

I'm writing a "back office" app and need a way to unlock an account in an automated fashion. Yes, I know security of nodejs is questionable, but there are ways of solving this. blocking web3 from ...
17
votes
3answers
5k views

How does the Ethereum ETH accounting system work and prevent double-spends?

In Bitcoin, the BTC accounting system is based on UTXOs (Unspent Transaction Outputs), which prevents the same BTC from being spent multiple times. I heard that Ethereum has a simpler account balance ...
9
votes
1answer
642 views

What data will zk-SNARKs protect?

Implementing zk-SNARKs is planned in Ethereum roadmap, what data will be obfuscated? transaction sender and receiver? data in transactions? data stored in contracts? variables and methods in ...
3
votes
1answer
119 views

Potential security issues warning banners with Ethereum

I'm testing ethereum and the foundation websites states that Frontier is an early access to the Ethereum network. Bugs and security issues might be present. Before downloading you have to agree ...
16
votes
2answers
5k views

Is it safe to reuse Ether addresses?

I believe it's viewed as unsafe in Bitcoin because of the way transactions are signed. Is this also true for Ether addresses?
14
votes
4answers
8k views

What Hierarchical Deterministic (HD) wallets are available for Ethereum?

A Hierarchical Deterministic (HD) wallet has some nice features such as easier backup (instead of needing to backup multiple keystore files and the passwords for each of them). Are there any ...
11
votes
2answers
199 views

How dependent is the ethereum client on the router and DNS being trusted?

Another way to put it: what is the root of trust for a full client on a network that has a potentially untrusted (or "owned") router+DNS? As I was going through the ethereum wiki semi-randomly, I ...
19
votes
4answers
5k views

Is there any safe way to send money from a cold wallet, using an untrusted computer?

You have 2 computers. One is 100% offline and, thus, trusted. Other is online. Private keys are stored on the offline computer and the online computer has no access to it. Is there any way to sign a ...
9
votes
1answer
827 views

What about illegal smart contracts?

Trying to get a friend excited about smart contracts I referred him to an ethereum pyramid scheme as an easy to understand example but he only pointed out that all pyramid schemes are illegal. How ...
6
votes
2answers
1k views

Is it safe to leave your account in an untrusted computer, as long as it is encrypted?

No modern OS is 100% free of viruses or hacking - and, even if it was, people can always just steal your computer. Assuming you can't be safe nobody will access your machine, is it still safe to keep ...
5
votes
2answers
392 views

Is it safe to generate an account with 256 coin flips?

Suppose one generates an account with the following procedure: Flip a coin 256 times; On a paper, write each heads as 1 and each tails as 0; Convert the 256-bit string to hex by mapping each 4-bit ...
8
votes
3answers
1k views

Is there a point to hide Ethereum nodes with TOR?

From a privacy perspective, is there any point in trying to torify ethereum nodes? I know there's a script to do that in bitcoin, although doing so may ironically made the bitcoin node more ...
8
votes
1answer
485 views

Will Whisper work with Ethereum contracts, or should I try another way for sending secrets?

I'd like for someone calling a contract to be able to send me secret info. Lets say it's just the person's physical address because they bought something from me. They don't want to just put that info ...
2
votes
1answer
552 views

How do contracts interact, and how is the network secured? [closed]

I don't understand what it means when people saying things such as "(Ethereum) applications can interact with each other on the blockchain, so a library of useful functionality will gradually build up"...
9
votes
3answers
1k views

Can you attack/ddos/spam a single contract?

Can you make a denial of service attack against a Contract? By blocking a single contract (or ethereum-object) instance so it can't be executed? For example spamming it in some way, like repeadetly ...
2
votes
2answers
282 views

Is it possible to access Ethereum API via the browser?

How do you access the api's of ethereum via the browser? Say I wanted to make a one page app that updates every 1 minute with the block number. And where can I get a list of all the API variables?
21
votes
4answers
11k views

Does Web3.js have the functionality to create new accounts and unlock an account for a period of time for a series of transactions?

I want to create new accounts through my Dapp web interface and unlock a specific account so that transactions can be processed. I didn't see it in the web3.js documentation so wonder if that's on the ...
13
votes
2answers
1k views

If someone gets my geth keystore files, can they spend my ETH without knowing my password(s)?

I always assumed so, since geth requires a new password for every account, but just want to be sure.
8
votes
1answer
239 views

Is ethereumwallet.com generating the keys client-side?

Is ethereumwallet.com generating the all the keys, accounts and transactions client-side? Is it legit and safe to use? Is it possible to confirm the javascript has no backdoors? Can it be trusted?
18
votes
3answers
3k views

What are the limits to gas refunds?

Gas refunds are provided when clearing storage or calling SELFDESTRUCT on contracts. The Yellow Paper mentions that refunds are "being capped up to a maximum of half...". What exactly is this "half" ...
2
votes
1answer
471 views

What's involved in making a private chain become a sidechain of Ethereum?

"A private Ethereum-based network that had a linkage allowing ether to be securely moved from the public Ethereum main chain onto it and back would be considered to be a sidechain of the public ...
7
votes
1answer
780 views

How does Ethereum avoid mining pool centralization?

As a proof-of-work (PoW) based blockchain, how does Ethereum combat mining pool centralization, which can lead to an entity controlling the majority of hashing power?
8
votes
1answer
7k views

Security measures to overcome 51% attack

I was reading During a 51% attack, What Can the Attacker Actually Accomplish? from there, i understand the after-effects are something serious, so what are the security measures which ethereum have ...
16
votes
2answers
2k views

During a 51% attack, What Can the Attacker Actually Accomplish?

During an attack on the network, where the attacker has more than 51% of hashing power (or the equivalent of Ether in PoS), what can the attacker do and not do to the chain and the contracts on it? ...
4
votes
1answer
271 views

Security of PoS if/when Assets (Tracked or Native) to Ethereum exceed the total Value of Ether

Given that Ethereum naturally allows for the creation of arbitrary tokens that can either have value themselves or track a real-world asset, can Ethereum be secured by PoW/PoS when the total assets on ...
48
votes
4answers
11k views

Is there anything stopping me from using the ethereum blockchain as data storage?

As I understand it, smart contracts are currently immortal by default. Does this mean that I could create a contract that happened to contain an encoded form of baby photos and have it stored forever? ...
26
votes
1answer
4k views

When can BLOCKHASH be safely used for a random number? When would it be unsafe?

I've seen more complicated ways for a contract to generate a random number. But the Ethereum Yellow Paper itself suggests a "trivial solution" using the BLOCKHASH opcode (see below, bold is mine). ...
7
votes
1answer
262 views

Ethereum walk-through

Would the following story line be a fair approximation of how Ethereum would work in this simplistic scenario? Simple network with just three nodes: N1, N2 and N3 N1 writes a contract that initiates ...
25
votes
3answers
6k views

Can a contract safely rely on block.timestamp?

How safe is it to use block.timestamp as contract expiration time? If a miner provides an incorrect timestamp in a block header, how much can it be off before it is rejected by other nodes? Is there a ...
16
votes
3answers
1k views

What are effective and secure ways of shuffling a deck of cards in a contract?

We want to write a card game in Ethereum. What are effective and secure ways of shuffling a deck of cards in a contract, and dealing them to players? It needs to be done in a way so that no one can ...
26
votes
3answers
3k views

Is Ethereum secure against an attack by quantum computers?

Does Ethereum implement Post-quantum cryptography? Or will the network break once a malicious actor gains control of an effective quantum computer?
2
votes
1answer
316 views

How will the number of confirmations for security change with Casper?

How will this answer change when Casper is deployed?
57
votes
5answers
76k views

What number of confirmations is considered secure in Ethereum?

In Bitcoin, 6 confirmations are considered secure (very low probability of transaction/block reversal). What is the current number in Ethereum?
47
votes
3answers
12k views

Why can't contracts make API calls?

The model that contracts can only accept and process data, instead of also being able to retrieve data from the Internet, seems limiting (even if not, it's less direct). If a concern is that data or ...
13
votes
2answers
718 views

Why does Ethereum have gas?

Why does Ethereum have gas? What other approaches could Ethereum have used to work around the Halting Problem?
16
votes
5answers
2k views

How will regular users be able to use dApps without buying ether?

Requiring users to get ether before they can use a dApp, is too much of a barrier for any kind of mainstream adoption. If dApps offer free ether in a naive way, they can be attacked by Sybils where a ...
5
votes
1answer
119 views

Who keeps the Ether when a transaction triggers an exception?

An audit had "Strong Recommendation: We recommend that exceptions cause all value to be returned to the sender, not the recipient." What were the technical reasons for not implementing this ...
8
votes
2answers
249 views

Could parasite contracts cripple the Ethereum ecosystem?

This critique of Ethereum presents leeching Parasite Contracts as a problem. A Parasite Contract accesses data from other contracts (which may be charging fees for the data), and offers the same data ...
17
votes
1answer
1k views

What if I had the private key that had the public address of a contract?

Could I spend the money a contract owns if I had the private key that goes to the public address that a contract resides at? (I realize that I'd have a better chance of being struck by lightning ...
20
votes
3answers
5k views

How does Oraclize handle the TLSnotary secret?

Oraclize claims to offer a provably honest secure retrieval of a webpage by taking advantage of TLSnotary (a service that allows an auditor to verify if a specific web page was accurately retrieved) ...