Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
1
vote
0answers
28 views

Build blockchain application that has some off-chain functionalities

I am learning about blockchain and I have a general question. Let's say that I want to build my custom blockchain based on Ethereum. My implementation has many nodes and few of them are chosen ...
1
vote
1answer
25 views

What would happen if someone tried to use Ethereum with a modified version of the client?

Let's say that I try to use Ethereum with a modified version of the client which does not follow all the rules of the protocol. What stops my client from being able to damage the Ethereum network?
1
vote
3answers
105 views

Game: Is it possible that someone could exploit a counter and always win?

I've made a game that depends on a counter, the first user that get to the target wins. Can someone exploit this and always win? I know that everyone can know the current count, but since there are ...
1
vote
2answers
139 views

Do I have to worry about signing transaction?

I'm using truffle & ganache to test a simple voting app. Do I have to worry about security and transaction signing or is it managed for me ?
2
votes
1answer
768 views

How does MetaMask save our mnemonic phrase? Is it safe enough?

How does MetaMask save our mnemonic phrase? Is it saved in browser local storage? Does it encrypt our mnemonic phrase?
0
votes
1answer
84 views

Given that ABI resides publicly on blockchain, why can't anyone call transferFrom() and steal tokens?

I am just trying to understand how it actually works and how the assets stored on blockchain are protected. Since ABI definitions are public, contract address too is available, can anyone interact ...
1
vote
1answer
869 views

ETH stolen from two MEW wallets & moved to an unknown address & then to ShapeShift

I recently found out that my ETH funds were stolen from two MEW wallets and moved to an unknown address. Below are addresses of my two MEW wallets. 1) 0x16bf750Ee569F0A173BCCfD7b3F92F9Bb46c6AfC (...
0
votes
0answers
154 views

What are the best practices for handling private keys on behalf of dApp users?

I have seen many answers and theory about it but didn't find any concrete example of how it should be done.
2
votes
1answer
225 views

Is it possible write a test for Truffle to validate that I am preventing unpredictable state variable changes in my contracts?

I recently read this paper on designing secure smart contracts, and it gives the following modifier to ensure that when an EOA (or contract address) interacts with your original contract that the ...
0
votes
1answer
117 views

Is it safe for smart contracts to handle secrets?

Is the runtime environment of a smart contract going to be seen by the hosting node? If not, how? Can the smart contract safely pass an API key to memory? Should Solidity developers just deem smart ...
1
vote
1answer
166 views

Implication of hacking into an ethereum node on proof of stake

It is my understanding that in proof of stake, the validator puts up a stake that gets slashed if they don't respond to requests truthfully. In the scenario that someone hacks into your node, wouldn't ...
0
votes
0answers
39 views

Are functions in contracts visible to everyone who has the block chain?

I have an experience with back end development and I am just getting started with Etherium, but I am a bit confused about something. In Back End development, we mostly assume (if everything goes ...
0
votes
1answer
67 views

Can a miner compromise an EVM that runs a smart contract?

For example, there is a private storage variable which cannot be seen by any user during the execution of the smart contract. When a miner runs the smart contract in a local EVM, can it infer the ...
2
votes
1answer
173 views

(Ethereum Game) How can you prevent people from simply calling the contract function that adds xp to their character?

If you are creating a game where your character receives xp after every time they play, how can you prevent people from just calling the "addXP()" function from the contract and giving their player ...
1
vote
0answers
324 views

Is it safe to use web3.eth.accounts.create() in frontend?

web3.eth.accounts.create returns the address along with private key so I was wondering if is it safe to call it using plain JS in website frontend instead of doing it server side in Node? My use case ...
1
vote
1answer
643 views

How to use the Ledger Nano S hardware wallet without installing Chrome?

How can I use the Ledger Nano S hardware wallet with FOSS only and hence without having to install Google Chrome on my Debian machine? I'd like to use for it ethereum and altcoins.
3
votes
1answer
704 views

DApp sign transactions on mobile and transfer to server - Web security

I'm currently developing an app for iOS and Android using React Native where users will have a wallet, made using: https://www.npmjs.com/package/ethereumjs-wallet-react-native. They then are able to ...
0
votes
1answer
80 views

Can host nodes trust smart contracts? Can smart contracts trust their hosts?

Is it safe for the hosting node to run smart contract? What if someone writes a malicious contract and try to give instructions the hosting node? Can smart contracts trust hosting nodes? Hosting nodes ...
1
vote
0answers
48 views

How to limit transactions to only approve addresses?

I am dealing with a private consortium scenario (private Ethereum network) where all participants are known in advance and have assigned an addresses used in genesis. Like to know if its possible to ...
3
votes
1answer
257 views

Vulnerability to Meltdown and Spectre?

Being a distributed computing platform, is Ethereum vulnerable to Meltdown and Spectre attacks?
0
votes
2answers
94 views

Is there a way to use A Smart Contract to Read Memory and Write to the blockchain?

Could someone create a smart contract where the target would be to read kernel memory (using some exploit) and then at the end of the smart contact it would write the kernel memory to the blockchain?
0
votes
1answer
440 views

What's wrong with generating private keys in this way?

Mostly out of curiosity, but if you wanted to generate your own ethereum private/public key pair, and NOTE use anyone else's code, is there anything that's wrong with doing it like this: const ...
5
votes
2answers
2k views

Honest lottery winner generation - pseudo random number obtaining

Suppose I would like to organize a honest lottery and prevent cheating when we need to find a winner. I known problem of random number in the known network arises. I would like to try the following ...
0
votes
1answer
71 views

Automatically test who can withdraw Ether from a smart contract

Is there any way I can automatically test who can withdraw ether from a smart contract? I need to perform this test automatically. So I cannot manually inspect the instructions. Can I design a smart ...
2
votes
1answer
864 views

Solidity Security

I'm new in security of ICO and smart contracts. Trying to find bugs in verified contracts. I believe I found some problems in 0x42dB5Bfe8828f12F164586AF8A992B3a7B038164 but I dont know how to ...
0
votes
1answer
94 views

How to secure an “unlock”ed address?

I am using Parity and testing a mining pool. In order for the pool to work, I need to specify the --author address on the node running the pool software. I also need to have the payee accounts for ...
1
vote
1answer
612 views

Load an HD (Hierarchical Deterministic) Wallet

I'm trying to find a way to programmatically generate Ethereum addresses based on an initial seed and then extract any funds that land in those addresses. Here's what I've tried: Generated a 24 word ...
1
vote
1answer
380 views

Are there weaknesses in using Oraclize (or similar) for randomization?

I'm trying to learn about Ethereum Smart contracts and studying example code and existing Dapps. If I understand things (and I probably don't), Solidity cannot create random numbers, so developers ...
1
vote
2answers
690 views

Feasibility of blacklisting addresses

Probably a very naive question, but when attacks occur such as the etherdelta one yesterday, what's stopping having a system in place to basically freeze assets in a certain address before the ...
0
votes
1answer
427 views

How do I set the Ledger Nano S to display the recipient's full address?

Presently the Ledger Nano S is showing only the first few first and last digits, with the middle truncated. Why does it truncate the middle of the address? How do we display the entire address?
4
votes
1answer
902 views

Dealing with the short address attack

I'm writing a contract for an ERC20 token, based on Zepellin contracts. I noticed that their code doesn't handle the short address attack. Does it mean I shouldn't care about it?
3
votes
1answer
378 views

What attacks have been performed against the Ethereum network and contracts?

Every time I fire up a new Ethereum node, I run into that very slow patch of syncing from 2016Q3 due to a DoS attack on the network. What other attacks have been performed against the Ethereum network ...
1
vote
1answer
21 views

Coinbase deposit PLZ HELP [closed]

I deposited $ into Coinbase from my bank account, however the money hasn't cleared yet and it will only be available in 7 days. Do I get the price of ETH BTC LTC when I clicked 'BUY' (although it hasn'...
0
votes
1answer
180 views

Limitations of JavaScript api on client side?

I notice that the Ethereum Javascript API allows the development of client side web based apps. Are their limitations or security gotchas to be aware of when developing such an app? Parts of the API ...
0
votes
1answer
35 views

Leverage short positions in decentralised PoW currencies

Hint I asked this question in a similar style already on bitcointalk and on bitcoin.stackexchange. But in these threads, there are no good answers and I thought maybe it would be better to ask the ...
1
vote
1answer
732 views

Is it possible to create an X.509 certificate from an Ethereum/Bitcoin private key?

We all love Ethereum/Bitcoin (i.e. EC secp256k1) private keys, because they let us sign transactions. However, browsers don't support those keys for authentication -- what they do (sort of) support is ...
2
votes
1answer
879 views

Is it secure to run public ethereum node? [duplicate]

I'm creating my first Ethereum contract with truffle. I want the web application to be usable without MetaMask so I was wondering if it is a good idea to run my own private node and to connect from ...
2
votes
1answer
490 views

Which JSONRPC APIs are required by MetaMask?

This question is related to What RPC APIs are safe to expose? I want to run a Parity node not to have a wallet but only to have my own personal JSON RPC node for MetaMask. Parity will not be running ...
0
votes
1answer
216 views

Is it better to store my MyEtherWallet password in a password manager or memorize a less secure one?

I figure I could either use a secure password manager to generate a long, randomly generated password for my keystore file, or could come up with a less secure passphrase that I memorize. Which method ...
9
votes
2answers
1k views

Persistent “deep transaction reorg” whilst syncing full geth node

Whilst syncing a new full node using the geth comand "geth --syncmode full", every other line after a few hundred blocks I see the following: WARN [12-02|02:30:46] Skipping deep transaction reorg ...
1
vote
1answer
180 views

Unable to replicate short-address attack

I was reading about the short address attack and decided to replicate and test the possible solutions. What I know about short address attack is if you skip n characters of your address, you end up ...
1
vote
2answers
474 views

Is it secure to rely on 'now' or 'block.timestamp' for the deadline of an ICO?

I am planning on launching an ICO and have been reading through the security recommendations for writing solidity contracts. My ICO checks if the deadline has been reached by using if(now >= ...
1
vote
2answers
8k views

Is Trojan:Win32/Tilken.B!cl a real threat? Trojan horse on geth files

Windows Defender accused some geth and ethereum files to have a trojan horse called Tilken.B!cl file: C:\Program Files\Geth\uninstall.exe file: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\...
0
votes
1answer
190 views

Web wallet best practices

I'm putting together an ether/erc20 token wallet in a chrome extension but would like to follow best practices with regards to private key security. I'm using localstorage to handle login and its ...
0
votes
1answer
43 views

Security: Creating transactions through downloadable app

Let's say I own a smart home ecosystem and a mobile app that users can use to turn on their air conditioner. Is there a way to incorporate blockchain so that no one else can turn on that air ...
0
votes
2answers
514 views

How can I prevent a 51% attack on my Ethereum based blockchain

I am intending at some point to open up access to an Ethereum based blockchain. I don't want to call it a private blockchain as I want it to be public. Is there some best practice to prevent a 51% ...
8
votes
7answers
3k views

Security analysis tool for Ethereum smart contracts

I'm looking for the best value affordable code checkers to find vulnerabilities in solidity code. I came across on Mythril[1] but I wonder which other products are used. [1] https://github.com/b-...
7
votes
3answers
3k views

Storing and passing encrypted data to another owner

I've been thinking about this situation for quite a while and I wonder if there is a way to solve this on the public Ethereum blockchain. User A stores some data on the blockchain, encrypted in some ...
0
votes
1answer
990 views

ERC20 tokens taken from MyEtherwallet

99% of my ERC20 tokens have all been taken out of Exodus Please someone help me! After one day of registering with myetherwallet my tokens went missing... I bought 10 differnt ERC20 tokens in ...
0
votes
1answer
357 views

What are the most common attack patterns on a Smart Contract? [duplicate]

i'm new to Solidity. After writing my first smart contract im fairly concerned about it's security, once deployed to the MainNet. What are the most important things i should check within my code? ...