Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
1
vote
2answers
292 views

How does ethereum bypass the NAT

I wonder, since Ethereum is based on a decentralized p2p network, how does it get through the NAT Firewall? There is no server Ethereum can connect on, so there has to be a way for nodes to accept ...
0
votes
2answers
83 views

Is it necessary to store transaction data into a database?

I am wondering if there are no security risks if i store transaction data in a database besides the fact that is stored on the ethereum blockchain. I am using an API to manage my smart contracts and ...
2
votes
1answer
74 views

Can ownership of a solidity contract be relinquished?

I'd like to maintain ownership of a set of contracts for a period of time to build them out, but eventually I'd like to relinquish ownership so that the users don't have to trust me to not steal their ...
4
votes
1answer
220 views

ERC20 transfer - caller expects return but none provided - what happens?

If someone implements the ERC20 transfer() function without the return value as follows: function transfer(address to, uint256 value) public { require( ... usual checks ... ); balances_[msg....
1
vote
1answer
94 views

How to Include a Lock that will Stop Your Tokens from Being Listed on Exchanges?

We are working on a security token sale and are aware we may need to be able to "lock" our tokens, not from being transferred from person to person but from being listed on any exchanges decentralized ...
1
vote
1answer
112 views

Can miners read the restricted data on our Smart Contract?

I'm thinking to store around half a dozen private keys on a smart contract. The function to read private keys is restricted to owner (deployer) of the smart contract. Do miners have access to the ...
1
vote
0answers
24 views

security and implementation challanges when launching the token

I would like to know what are security holes when launching an ERC20 token or other tokens. Below is my process of launching token: Creates an ERC20 token contract with truffle. Defines network ...
0
votes
0answers
118 views

Where is the security in http provider for a blockchain node IP address?

I have the code below. In testing this actually works but there is no security from what I have seen. The node is at an IP address and the node code just states the default account is coinbase. So ...
2
votes
2answers
551 views

Smart contracts and the inherent lack of security in trusting compiled byte code

Smart contracts on the blockchain are compiled. Is there any system in place to verify all the public dapp contracts do what they propose to be doing? i.e. this could be done by compiling open-source ...
1
vote
2answers
398 views

Automatic transaction

I would like to know if it was possible to automatically send any ETH amout to an address "B" just after receiving them on an address "A"? Maybe via a script? I need help
2
votes
2answers
196 views

While using myetherwallet to generate offline transaction hash, can developer steal my private key?

To be very clear, I have used myetherwallet offline to send eth many times in the past. I went through the code for the version I saved and found no Maliciously code. Hypothetical for future ...
1
vote
1answer
199 views

Does running a light client add extra security for Ethereum compared to doing nothing?

These may answer the question: https://github.com/ethereum/wiki/wiki/Light-client-protocol https://blog.ethereum.org/2015/01/10/light-clients-proof-stake/ Of course you want to be secure, but ...
0
votes
2answers
324 views

pragma solidity ^0.4.11; vulnarability

As stated on this website http://fluidai.co/examples/ one of Solidity's vulnerabilities is using an open version in pragma: pragma solidity ^0.4.11; You're telling the Solidity compiler to use ...
0
votes
1answer
459 views

Can a smart contract transfer (steal) another contract's tokens? [duplicate]

Let's say I have an ETH address and that same address holds AAA, BBB and CCC tokens. Each token symbol is managed by a different contract (each contract was created by a different person/organization ...
6
votes
1answer
664 views

Read private data of smart contracts from Blockchain

Is there any way to read smart contracts private or internal data from Blockchain? The smart contract data is on Blockchain so probably the data can be read from servers. Is data encrypted on ...
1
vote
1answer
312 views

Best practices for a secure Ethereum private network? [closed]

What are the best practices for an Ethereum private network with n nodes (programmed with Geth), to be secure from possibles external attacks? I mean, which config parameters are recommended during ...
1
vote
1answer
464 views

About security of web3.js when running inside a browser

Please explain how authentication for "protected" operations (such as withdrawal of money from a wallet) is handled in web3.js when it is run inside a customer's browser. Please also explain how it ...
0
votes
0answers
73 views

Is it possible to get direct access to a contract?

All contracts have addresses. Is it, in theory, possible to find the private key of this address and then get access to this contract? Questions if this is possible: If one gets access to the ...
2
votes
1answer
69 views

Modifier for no-contract calls [duplicate]

The modifier used to check if a contract calls a function in Solidity used the assembly code extsize. I wonder why this is done. Using assembly seems very "hackish" to me (why does solidity not have a ...
2
votes
2answers
119 views

What are the risks of using tokens that appear to have ERC20 standard?

Say someone sends some ERC20 (supposedly) tokens to my ETH address. I then use transfer() function to send these tokens to some other address. The question is - by using a "transfer" function do I ...
10
votes
1answer
148 views

Is it dangerous to name my function ccccvKygDv?

For those keeping track at home, the function hash of a function named ccccvKygDv() is 0xffffffff, the same as a null address. pragma solidity ^0.4.0; contract NullFunction { function ccccvKygDv()...
2
votes
1answer
263 views

How to implement user deposits for tokens for an exchange

If we generate new deposit addresses for every user we face following problems: - we need to transfer tokens from individual wallets to our exchange wallets - we need to fund the wallets with ether to ...
0
votes
1answer
166 views

How to avoid using tx.origin when we really need it?

It's been recommended that we should avoid using tx.origin. However, there're some cases it's really needed, like the following case. Assume we have two smart contracts: Sc1 and Sc2, both of which ...
0
votes
0answers
43 views

What inputs to smart contracts can be maliciously modified by miners, beyond timestamps? Why isn't this caught by mining verification?

Are there other trusted inputs which miners could maliciously modify which still get accepted by blockchain verification? I realize the timestamp can be modified in a small way to potentially modify ...
0
votes
1answer
182 views

OpenZeppelin Pausable Concept, Security Concepts

Are items like the OpenZeppelin Pausable contracts any different than just having additional checks inline with standard Solidity? If a coder just placed checks in front of every function call with ...
0
votes
1answer
263 views

Can a smart contract steal ETH?

I know that handing out your private key is like handing over your wallet and say "help yourself", but... if I had register my public ETH address on some unknown smart contract (like sending a "...
1
vote
2answers
37 views

Dos with revert

While I was reading a guide on smart contract security (by consensys) I found this: // INSECURE contract Auction { address currentLeader; uint highestBid; function bid() payable { ...
0
votes
1answer
62 views

Is it viable to use a smart contract for string based authentication?

I am aware that security on the network is done at the private key level, but would love to know the security implications of having an additional password/string and time-based level of security on a ...
2
votes
2answers
2k views

What does msg.sender.call() do in Solidity?

Hi was going through solidity documentation. There was some code that I was not able to understand, even after researching a lot I was not able to find some satisfactory output. The code is as under: ...
0
votes
1answer
196 views

transfer/send error cases

I have a (noob) question on the usage of transfer and send. I have seen that transfer is equivalent to require(x.send(k)); When I use send() I know that I have to check whether there was an error ...
3
votes
1answer
154 views

Upgradable Smart Contracts - Is there consensus between shareholders when upgrades occur?

It seems that upgradable smart contracts are the new wave of the future seemingly for the all the right reasons. How does this work for the "hello world" smart contract where two users make a bet on ...
0
votes
1answer
262 views

Threat Model Question - Code Injection / ROP possible in Ethereum Smart Contracts?

I am trying to understand a basic threat model for Ethereum Smart Contracts, to perform some research on how existing attacks techniques may be applied here as well. Is there a risk of a contract with ...
7
votes
1answer
2k views

How should I secure a private key in my dapp?

We are currently building an app that interacts with the blockchain. It needs to be able to make transactions on the blockchain on it's own - for instance to add addresses to a whitelist. This means ...
0
votes
2answers
73 views

What bad things could happens if Geth RPC is public?

Geth does not ship with RPC support. By default Geth enables modules ["net", "web3", "eth", "shh"]. In case the RPC get compromised, what kind of bad things could happens? Money lost will definitely ...
1
vote
1answer
278 views

Are the contents of ethereum storage private? [closed]

I know that the code is public, but is the contents of storage private?
1
vote
0answers
32 views

Are API tokens incompatible with Ethereum apps?

I want to build an Ethereum app that gets weather data from a trusted (government run) API via oracilize. This service requires an API token to be sent with each request to prevent abuse. Each API ...
2
votes
3answers
340 views

Doesn't having a centralised front end pose a huge security risk to an Ethereum app?

My understanding is that the typical architecture for an Ethereum app is to have a smart contract acting as a backend to a centralized, stateless front end which runs on a single server. Doesn't this ...
5
votes
1answer
224 views

Can I make a “secret” invite only Smart Contract?

I have a public smart contract where I am able to make a secret and hash it within the contract. I then share the "secret" with N number of my friends and with the secret they can create a new hash (...
3
votes
2answers
207 views

Why this ERC20 “stealing” transaction is valid?

I'm sending a token from account A to B. The account who issues transaction is C. Surprisingly, the transaction is valid and works fine. Why? This means that I, being the transaction issuer, can make ...
3
votes
1answer
419 views

Could msg.sender be changed by a hacker?

I was researching the msg object and I could not find out very much about how it is created. It seems to be that contracts depend on checking owner == msg.sender. That is dependent on msg.sender being ...
1
vote
1answer
84 views

Implementing security feature on token contract

I am trying to implement a security feature on a ERC20 Token for the event of a vulnerability on it's code or the solidity core. This feature consists basically in two steps : First, the owner of ...
0
votes
1answer
132 views

Are there any security issues to send token in fallback function?

I want to have a contract that releases an erc-20 token as soon as someone pays ether to contract. Let's call this contract Bid Contract. The abstract code goes like: function askForTokens() public ...
1
vote
1answer
243 views

How external functions call works in Solidity? Synced or Asynced?

function redeem(uint256 _token) public { // transfering the token from tokenholder to owner token tokenBalance = token(tokenAddress); tokenBalance.transferToOwner(owner, _token); // ...
2
votes
1answer
375 views

How does this honeypot contract work?

I've been trying to pick this honeypot contract apart, but I haven't figured out exactly how it works. overview The premise is pretty simple, the contract is set up to look like a "new year's gift" ...
0
votes
0answers
84 views

Best practices to calling owner only functions from a website

I am following the web3 documentation and I found that its possible to sign a contract and do a transaction directly from web3. I want to call an onlyOwner function in my contract directly from a ...
3
votes
3answers
1k views

Why is there a possibility to increase block gas limit?

As I know, in Bitcoin block size is limited to 1MB. This limits the number of transactions in a block and thus the transaction throughput and blockchain size growth rate. This in turn prevents ...
0
votes
1answer
1k views

How can I restore a mnemonic seed with one missing word?

Anyone know how to restore an ethereum wallet from a seed that's missing only one word? I'm able write a program that will narrow down the possible seeds to like 1500 candidates which are considered ...
0
votes
2answers
171 views

Encrypted data and digital signatures in the blockchain?

Let's say that Alice publishes some data on the blokchain encrypted with Bob's public key. Bob then decrypts the data. Later Bob wants to prove that he is the owner of that data, that is he wants to ...
0
votes
2answers
116 views

Is it safe to remove the “view” modifier from the function “getTokenAmount” in the OpenZeppelin crowdsale contract?

This function from the openzeppelin crowdsale sample is marked view as seen here: // Override this method to have a way to add business logic to your crowdsale when buying function getTokenAmount(...
0
votes
1answer
40 views

How are organization level ethereum wallets and accounts handled [closed]

We are planning to have some of the smart contract functionality available to external users, but only if they go via our website. (Eventually, they will be accessible via usual contract calls ...