A message from our CEO about the future of Stack Overflow and Stack Exchange. Read now.

Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
1
vote
1answer
58 views

Smart contract consensus - underpinned by transactions?

I can easily visualise how consensus can be reached on transactions in systems such as Bitcoin, but I struggle to understand how consensus can work in a smart contract platform - i.e how can nodes ...
2
votes
1answer
81 views

Prevent other mining softwares to mine my public forked Ethereum chain

I forked an Ethereum chain and put it as public, but I only want my own software/client to be able to mine. Other miners using ethminer, geth, etc, cannot mine and profit from my chain (At least not ...
3
votes
0answers
61 views

Storing Private Keys in IoT Devices

In a network of IoT devices like internet-connected Raspberry Pis which sends transactions to the Ethereum blockchain, the Pis need to be able to access their own Ethereum private keys in order to ...
1
vote
1answer
64 views

Access manager in Smart Contract

I'm building a service where one can publish a crypted file on the internet which can be accessed and decrypted by people allowed. I don't want to store any crypted key on a server or something. For ...
1
vote
2answers
125 views

Solidity Checks-Effects-Interactions Pattern

From the solidity docs: Use the Checks-Effects-Interactions Pattern Most functions will first perform some checks (who called the function, are the arguments in range, did they send enough Ether, ...
0
votes
1answer
108 views

Delegated Proof of Stake (DPOS) vs. Proo of Stake? [closed]

What is the main difference between Delegated Proof of Stake (DPOS) vs. Proof of Stake? Is there any significant advantage for security? (since PoS in general suffers security problems.) And which ...
0
votes
1answer
601 views

How secure is using port 8545 from the internet (aka via JSON), can someone steal my ether?

Just noticed I can access 8545 from localhost but fortunately not from the web/internet. Do I need this at all? e.q. I read about someone who had lost $20 million due to someone else sending a call ...
1
vote
0answers
37 views

MIME types in Ethereum

Yesterday evening, an individual(at a french meetup haha) asked me what ethereum was and kept asking me if there was something similar to MIME types on Ethereum. I did not know what MIME types were ...
0
votes
1answer
221 views

Race condition in Ethereum

If I have several transactions in the same function, can I be sure that they will be executed one just after the other. Example with a dummy code: Contract store { constructor() public returns(...
2
votes
1answer
63 views

Trustless Inter-chain transaction with Bitcoin- are there any flaws?

Let's say that Alice wants to send Bob 1 BTC, and in return Bob will send Alice 1 ETH. Alice's Bitcoin address is BTC_A, and Alice's Ethereum address is ETH_A. Likewise, Bob owns addresses BTC_B and ...
1
vote
1answer
235 views

How to hide/protect smart contract arguments

In Ethernaut level 8 you are given this contract to hack: pragma solidity ^0.4.18; contract Vault { bool public locked; bytes32 private password; function Vault(bytes32 _password) public { ...
0
votes
1answer
51 views

Is transaction triggered by web3 secure on the internet?

I'm trying to construct my business architecture using ethereum. I'll operate public ethereum node and private business server on the AWS. I'll trigger transaction from the private business server ...
1
vote
1answer
185 views

Using Hardware Security Modules to generate and store private keys on private ethereum / quorum

For a private ethereum networks, has anyone used Hardware Security Modules (HSM) to generate and store Ethereum private keys? I am keen to know how public/private keys are managed without a PKI (...
0
votes
1answer
109 views

Security Implications of allowing remote RPC connections to Geth Node

What are the security Implications of allowing remote RPC connections to Geth Node? If one absolutely needs to allow remote rpc connections for web3 connection, how can one do this while securing the ...
1
vote
1answer
306 views

How does the exploit in FOMO3D work?

With the recent release of the FOMO3D exploit in its smart contract, how does the exploit work?
0
votes
1answer
194 views

Solidity SafeMath library best practice use cases

I understand why and how to use the SafeMath library. However, I was wondering if there is a kind of best practice guide how and when to use the library and in which cases you don't have to. From a ...
0
votes
0answers
25 views

Storing generated accounts. Security

I originally built a system that had a front end where users simply entered some details and a password which then generated them a wallet and emailed it to them. My aim was that the user could then ...
0
votes
1answer
186 views

Detecting whether a transaction was cancelled (because a block is orphaned)

I'm writing a system where some transactions have to be automatically detected, and wait for 30 blocks to ensure they're confirmed. What I do is that I read all new blocks, and find the transactions ...
0
votes
1answer
224 views

Solidity - Shuffle address[] Index

Hello World ! I'm trying to find a way to shuffle an array of addresses in Solidity ! Looking at Underscore / Lodash source code _.shuffle() points out a few things. _.shuffle([1, 2, 3, 4]); * // ...
3
votes
0answers
103 views

Parity create testing transactions and blocks

For test purposes, I would like to make test blocks including test transactions against main net. For example I would like to make a transaction that sends one ether from 0x1234567... to 0x99999999......
2
votes
1answer
339 views

Keeping private key for signing transactions on a local server

Need an idea for not storing private key to sign transactions (on public server/database file system). The private key is needed to sign the transactions for transfer function ERC20 standard. To ...
0
votes
1answer
62 views

What kind of security measures do Testnets have in place?

Cryptographic work is spent verifying transactions on Ethereum, without which, there would be little to nothing preventing colluding to start a 51% attack or creating false identities to start a Sybil ...
0
votes
1answer
110 views

Quorum Consensus - BAR (Byzantine Altruistic Rational) Fault Tolerance / BAR Fault Tolerance / BAR Model

I refer to http://www.cs.utexas.edu/~dahlin/projects/bft/ http://www.cs.cornell.edu/lorenzo/papers/sosp05.pdf http://www.cs.northwestern.edu/~fabianb/classes/cs-443-w07/BAR.pdf https://blog.ethereum....
0
votes
2answers
599 views

Division/Percentages in Solidity (a workaround)

Division/percentages is a required part of many applications but is difficult to implement since fixed and ufixed are not supported yet in Solidity. I've come up with this workaround: pragma ...
0
votes
1answer
153 views

Whether Geth is safe to install?

I'm using Windows OS and is my private computer. Norton Internet Security says : Firewall rules were automatically created for geth and Intrusion Prevention is monitoring network traffic. Can ...
1
vote
3answers
2k views

How to generate multiple eth-addresses from one private key? [duplicate]

Is it possible to generate different multiple eth-addresses from one private key? The goal is to implement a JavaScript service that will allow a user to buy a subscription using cryptocurrency. ...
0
votes
1answer
267 views

How does Ethereum account state change? [duplicate]

Ethereum uses Accounts instead of UTXO (Bitcoin). I would like to know how does the ledger keep the account state (technical details if possible)? Does it modify the ledger (accounts) by incrementing ...
0
votes
1answer
106 views

Most expensive solution for miners to manipulate PRNG (Pseudo Random Number Generation)

From this article I understand that randomness can only be secured by External oracles Signidice Commit–reveal approach However, in the case that I am okay to have a pseudo random ...
1
vote
1answer
116 views

How are encrypted Oraclize queries protected against replay attacks, precisely?

The Oraclize API allows users to encrypt a query or part of a query using their public key "to protect data from public scrutiny," to quote their documentation. The documentation has this to say ...
0
votes
2answers
1k views

Is it possible to regenerate my seed phrase if I have my private key?

The thing is I lost my seed phrase for MetaMask wallet. Luckily I had also backed up my private key. Is it possible to regenerate my "seed phrase" from my private key? It would be great if I could do ...
0
votes
1answer
38 views

When a Callcalled contract calls an other contract normally, who is msg.sender?

If I understand correctly CALLCODE substitute/replace (and not add) the ledger of the target contract with the one the calling contract, isn’t it ? So that when contract Victor CALLCODE Alice, Alice ...
1
vote
0answers
84 views

Unlock account on Ethereum client, or sign every transaction sent it to Ethereum client?

I have a contract which needs to be updated occasionally. For this purpose, I set up an Ethereum client, namely, a Parity node. At this point, I see several ways of carrying out the specified task: ...
0
votes
1answer
28 views

If a malicious party attempts to close a Raiden payment channel with incorrect balances, can they steal the deposit?

If a malicious party attempts to close a Raiden payment channel with incorrect balances, can they steal the deposit if the other party doesn't respond? If they close the channel and transmit that ...
6
votes
3answers
587 views

What’s the point of checking msg.sender≠0 ? Are there cases where msg.sender can be null?

In the Tron contract (a large ICO listed on many exchanges) lies this modifier which is used for all token transfers : modifier validAddress { assert(0x0 != msg.sender); _; } I understand ...
1
vote
2answers
507 views

How to secure a private chain?

Recently I've setup a private chain on cloud (to be more accurate, it is a separate public chain), after a few days, I found that there are some strange transactions sending ether to the same account ...
4
votes
1answer
124 views

Malicious smart contract and stolen tokens from other contracts?

I'm wondering if by interacting with a contract, it could affect my ETH or tokens on other contracts. I'm asking because I'm seeing many EOS airdrops on ethereum that require us to send a 0 ETH ...
-1
votes
1answer
93 views

why i have a lot of warnings in the function setprice part? Thanks [duplicate]

Can some one help in explaining why i have a lot of warnings in the ( function setprice ) part and why the contract dont compile in the Ethereum Windows wallet? I added the ( function setprice) so ...
0
votes
2answers
387 views

Storing Secret in Smart contract [duplicate]

i am currently storing a secret (string) directly inside a smart contract. The idea is that the smart contract only allows authorized people to obtain the secret. The problem is that the smart ...
5
votes
3answers
3k views

Blockchain password manager

Is there a blockchain, or a smart contract designed to store user passwords? I am using a proprietary password manager and have hundreds of passwords stored there. I am just a bit worried that the ...
0
votes
1answer
163 views

Can anyone freely call the `tokenFallback()` function in ERC223?

Since the function seems to always be implemented as public, can't an unfair user just call the tokenFallback() function of a receiver contract? That way one could let contracts believe that they ...
1
vote
1answer
104 views

Malicious node returning tampered data?

I understand concepts about how consensus is important to record data into the blockchain such that it is accurate and not tampered with. But, suppose a client queries the balance of an account, and ...
1
vote
1answer
51 views

In the case the Zerofunctionselector bug, how to know which function NAME as a 0 selector?

Normally, If a smart contract is not affected by the Zerofunctionselector bug, then at the end of the code which makes jump to the target function lies a 0xfe opcode (which result in the smart ...
3
votes
3answers
1k views

How to recover public from tx signature(r,s) and verify signature?

My first question is how to verify signature using only r,s and elliptic curve paramete, and an address (which is hashed of public key, so cannot retrieve public key from the address)? Next question ...
1
vote
1answer
44 views

Maximum security data comparison

I want to implement a small guess-the-word game on Ethereum, where the user needs to guess a word from a given set of words. The procedure is following: 1. The user attempts the guess. 1.1. The user ...
6
votes
1answer
278 views

Any understandable cryptography book/article/lecture to introduce to signatures, hashes, ECDSA etc..? [closed]

It's a long time I'm searching for cryptography lectures related to ethereum inside mechanisms, and everything I found has a high mathematical level. I'm an engineer, not a mathematics, so any article ...
1
vote
1answer
46 views

Account management risks of booting into Tails OS from USB using a “partially air-gapped” Linux PC

My threat tolerance is around a 3 out of 5 on the paranoia scale. What are the practical account management risks of using a flash drive loaded with Tails OS to boot into a Linux PC, which will only ...
0
votes
0answers
50 views

Hostile Takeover Of Minted Coin In Crowdsale

I am querying the warning on new crowd sales where minted tokens are made as per this guide: https://www.ethereum.org/crowdsale which reads as follows: Once you published the crowdsale contract, ...
7
votes
4answers
444 views

How to prove that a user owns their public key for free?

If a user claims to own a public key is there a way that I can query metamask or a web3 object and say "hey this guy is telling me that he owns this public key is that true?" I could ask the user to ...
1
vote
1answer
547 views

BFT vs On-chain POW

What significant advantages does BFT provide over On-chain POW solutions and why or why not are they not more commonly used?
1
vote
2answers
291 views

How does ethereum bypass the NAT

I wonder, since Ethereum is based on a decentralized p2p network, how does it get through the NAT Firewall? There is no server Ethereum can connect on, so there has to be a way for nodes to accept ...