Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
0
votes
1answer
26 views

Sharing an verifiable secret message in a contract

I would like to hear your opinion on my idea to share a proof of a secret message in a contract, that users can verify later in a second phase when the message will be revealed. If the message is a ...
0
votes
1answer
21 views

Is function like this one reentrant?

Got this in pseudo-code (Solidity like...) from audit of past work of person from our company, in short it seems to be withdrawing first and adding later. Maybe not a good idea, especially since it's ...
0
votes
0answers
14 views

Is function like that prone to reentrancy?

function transfer() payable public returns(bool) { balances[msg.sender] = SafeMath.sub(balances[msg.sender], msg.value); if(msg.sender.call.gas(100000).value(msg.value)()) { ...
0
votes
0answers
45 views

Unable to Unlock Account Even After specifying allow-insecure-unlock

Software: Ubuntu on VirtualBox Update, tried putting two dashes, on allow-insecure-unlock, doesn't work solidity@solidity:~$ geth attach http://127.0.0.1:8545 --allow-insecure-unlock Incorrect Usage:...
0
votes
0answers
16 views

Problem with understanding the solution for Transaction Ordeing Vulnerability

For the following paper, I can’t understand the text written below: https://arxiv.org/pdf/1806.01143.pdf Our violation pattern checks that the amount of the call instruction is determined by a ...
0
votes
0answers
15 views

Backward program analysis (like symbolic backward execution) tools for smart contracts

I know there are some backward program analysis tools for traditional softwares, but i wonder if there are already backward symbolic execution tools for smart contracts, or any tool that I can refer ...
0
votes
1answer
35 views

ERC20 vulnerability? Executing transferFrom undesirably

Say I have a contract called MyContract, and I require to send 100000 DAI to it. Ideally, I'd firstly call approve(<address of A>, 100000e18) in DAI's contract itself. Secondly, I'd execute, for ...
0
votes
1answer
33 views

How dangerous the 'short address' attack is as of 2019, October and what ways there are to mitigate it?

From what I read there's a well public knowledge of reantrancy and underflows/overflows due to the cases of documented hacks and stolen ether - yet the short address attack seems less known. I know in ...
0
votes
2answers
32 views

Is there a way to create double-spending transactions and submit them to different nodes?

I'm trying to create two transactions with the same nonce and send those transactions to two different nodes. Such as: const Web3 = require('web3'); const web3_1 = new Web3(rpcURL1); // node 1 const ...
0
votes
1answer
37 views

How to build security into Dapps?

I am building a loan dapp. The functionality is not easy to build but relatively straightforward. My question is though does anyone have any suggestions of how to build in user logins and security? ...
0
votes
0answers
15 views

Hidding IP address behind sentry nodes

I would like to know how to set up an Ethereum node behind sentries (proxy nodes). I know there are several ways to approach this issue as mentioned here. https://medium.com/@kidinamoto/tech-choices-...
0
votes
0answers
27 views

Can you verify transaction data by matching it to the transaction hash

TlDr; Can you use the transaction hash to confirm the integrity of the data components of a transaction (post data, addresses, nonce, etc). In my application, I have a connection to the Ethereum ...
0
votes
1answer
34 views

Gas optimisation for my art experiment spacecans.com

so I was microdosing some research chems and the thought came to me that I need to do some artsy blockchain stuff for once. It's two tin cans floating in space that you can advertise your so-called ...
0
votes
1answer
22 views

Risk of Messages Not Having a Signature

As per my understanding transactions are signed before sending to Ethereum. Else, no transfer of Ether will happen. However, messages sent to Smart Contracts (SC) aren't signed (e.g., using methods....
0
votes
0answers
32 views

how to implement erc1400 standard?

I am trying to learn about erc1400 and its implementation but couldn't find any complete implementation guide. Can someone points me to relevant links regarding erc1400 complete end to end ...
0
votes
1answer
59 views

Proxy function clashing - what kind of danger comes exactly with it?

I read that if I am using proxy, there is a chance of function clashing. Let's say in my contract there is a function with a signature: proxyOwner() ...
0
votes
1answer
60 views

User anonymity while submitting data in smart contract

I've written a smart contract, that is a crowd sensing system. Where post posting a task user view that task and if they have what I'm asking for/and meet the task requirements they submit certain ...
0
votes
1answer
8 views

How to restrict call to inherited public function

I'm using OpenZeppelin library for my project and I need to override some functions for business logic. But my concern is with given example, // contract from library contract A { function ...
0
votes
0answers
26 views

Understand the `call` opcode in this contract

Hello, I am posting a quick question regarding the functionality this contract: https://etherscan.io/address/6b63ea3612dde97082aab468157950f927618d31#code From the source code, I am not even able to ...
0
votes
3answers
35 views

How to prevent someone running a transaction before me?

Let's say I have the following in my smart contract: string passwordHash; uint money; function checkPassword(string cleanPassword, string newPasswordHash)[...] When running the function ...
0
votes
1answer
40 views

Is my function prone to under/overflow?

I don't like using safemath as this is my first conntract and this is getting a bit complicated for me so: function withdraw(uint xyz) public { require(balanceOf[msg.sender] >= xyz); ...
0
votes
1answer
51 views

Is transaction triggered by web3 secure on the internet?

I'm trying to construct my business architecture using ethereum. I'll operate public ethereum node and private business server on the AWS. I'll trigger transaction from the private business server ...
0
votes
1answer
109 views

Security Implications of allowing remote RPC connections to Geth Node

What are the security Implications of allowing remote RPC connections to Geth Node? If one absolutely needs to allow remote rpc connections for web3 connection, how can one do this while securing the ...
0
votes
1answer
195 views

Solidity SafeMath library best practice use cases

I understand why and how to use the SafeMath library. However, I was wondering if there is a kind of best practice guide how and when to use the library and in which cases you don't have to. From a ...
0
votes
0answers
25 views

Storing generated accounts. Security

I originally built a system that had a front end where users simply entered some details and a password which then generated them a wallet and emailed it to them. My aim was that the user could then ...
0
votes
1answer
186 views

Detecting whether a transaction was cancelled (because a block is orphaned)

I'm writing a system where some transactions have to be automatically detected, and wait for 30 blocks to ensure they're confirmed. What I do is that I read all new blocks, and find the transactions ...
0
votes
1answer
110 views

Quorum Consensus - BAR (Byzantine Altruistic Rational) Fault Tolerance / BAR Fault Tolerance / BAR Model

I refer to http://www.cs.utexas.edu/~dahlin/projects/bft/ http://www.cs.cornell.edu/lorenzo/papers/sosp05.pdf http://www.cs.northwestern.edu/~fabianb/classes/cs-443-w07/BAR.pdf https://blog.ethereum....
0
votes
2answers
607 views

Division/Percentages in Solidity (a workaround)

Division/percentages is a required part of many applications but is difficult to implement since fixed and ufixed are not supported yet in Solidity. I've come up with this workaround: pragma ...
0
votes
1answer
268 views

How does Ethereum account state change? [duplicate]

Ethereum uses Accounts instead of UTXO (Bitcoin). I would like to know how does the ledger keep the account state (technical details if possible)? Does it modify the ledger (accounts) by incrementing ...
0
votes
2answers
391 views

Storing Secret in Smart contract [duplicate]

i am currently storing a secret (string) directly inside a smart contract. The idea is that the smart contract only allows authorized people to obtain the secret. The problem is that the smart ...
0
votes
1answer
163 views

Can anyone freely call the `tokenFallback()` function in ERC223?

Since the function seems to always be implemented as public, can't an unfair user just call the tokenFallback() function of a receiver contract? That way one could let contracts believe that they ...
0
votes
0answers
50 views

Hostile Takeover Of Minted Coin In Crowdsale

I am querying the warning on new crowd sales where minted tokens are made as per this guide: https://www.ethereum.org/crowdsale which reads as follows: Once you published the crowdsale contract, ...
0
votes
0answers
118 views

Where is the security in http provider for a blockchain node IP address?

I have the code below. In testing this actually works but there is no security from what I have seen. The node is at an IP address and the node code just states the default account is coinbase. So ...
0
votes
1answer
459 views

Can a smart contract transfer (steal) another contract's tokens? [duplicate]

Let's say I have an ETH address and that same address holds AAA, BBB and CCC tokens. Each token symbol is managed by a different contract (each contract was created by a different person/organization ...
0
votes
0answers
73 views

Is it possible to get direct access to a contract?

All contracts have addresses. Is it, in theory, possible to find the private key of this address and then get access to this contract? Questions if this is possible: If one gets access to the ...
0
votes
0answers
43 views

What inputs to smart contracts can be maliciously modified by miners, beyond timestamps? Why isn't this caught by mining verification?

Are there other trusted inputs which miners could maliciously modify which still get accepted by blockchain verification? I realize the timestamp can be modified in a small way to potentially modify ...
0
votes
1answer
182 views

OpenZeppelin Pausable Concept, Security Concepts

Are items like the OpenZeppelin Pausable contracts any different than just having additional checks inline with standard Solidity? If a coder just placed checks in front of every function call with ...
0
votes
1answer
263 views

Can a smart contract steal ETH?

I know that handing out your private key is like handing over your wallet and say "help yourself", but... if I had register my public ETH address on some unknown smart contract (like sending a "...
0
votes
1answer
196 views

transfer/send error cases

I have a (noob) question on the usage of transfer and send. I have seen that transfer is equivalent to require(x.send(k)); When I use send() I know that I have to check whether there was an error ...
0
votes
1answer
262 views

Threat Model Question - Code Injection / ROP possible in Ethereum Smart Contracts?

I am trying to understand a basic threat model for Ethereum Smart Contracts, to perform some research on how existing attacks techniques may be applied here as well. Is there a risk of a contract with ...
0
votes
1answer
132 views

Are there any security issues to send token in fallback function?

I want to have a contract that releases an erc-20 token as soon as someone pays ether to contract. Let's call this contract Bid Contract. The abstract code goes like: function askForTokens() public ...
0
votes
0answers
84 views

Best practices to calling owner only functions from a website

I am following the web3 documentation and I found that its possible to sign a contract and do a transaction directly from web3. I want to call an onlyOwner function in my contract directly from a ...
0
votes
0answers
155 views

What are the best practices for handling private keys on behalf of dApp users?

I have seen many answers and theory about it but didn't find any concrete example of how it should be done.
0
votes
0answers
39 views

Are functions in contracts visible to everyone who has the block chain?

I have an experience with back end development and I am just getting started with Etherium, but I am a bit confused about something. In Back End development, we mostly assume (if everything goes ...
0
votes
1answer
71 views

Automatically test who can withdraw Ether from a smart contract

Is there any way I can automatically test who can withdraw ether from a smart contract? I need to perform this test automatically. So I cannot manually inspect the instructions. Can I design a smart ...
0
votes
1answer
94 views

How to secure an “unlock”ed address?

I am using Parity and testing a mining pool. In order for the pool to work, I need to specify the --author address on the node running the pool software. I also need to have the payee accounts for ...
0
votes
1answer
35 views

Leverage short positions in decentralised PoW currencies

Hint I asked this question in a similar style already on bitcointalk and on bitcoin.stackexchange. But in these threads, there are no good answers and I thought maybe it would be better to ask the ...
0
votes
1answer
190 views

Web wallet best practices

I'm putting together an ether/erc20 token wallet in a chrome extension but would like to follow best practices with regards to private key security. I'm using localstorage to handle login and its ...
0
votes
1answer
405 views

SafeMath in ERC20 tokens: throw vs return false

On the one hand, protecting from over- and underflow is a must, and a widely used SafeMath library can help with that. SafeMath throws in case of error. On the other hand, ERC20 token functions are ...
0
votes
1answer
454 views

Setting up MyEtherWallet on iOS device from Coinbase

Can I securely set up and store a MyEthereumWallet on iOS only without an computer? I want to transfer ethers from Coinbase.