Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
0
votes
0answers
21 views

Validating transactions with ZK methods

After reading some topics on the implementation of ZK methods in the Ethereum, how would this affect the PoW? Please have someone correct me if I am wrong (I started recently), but if the nodes need ...
0
votes
2answers
48 views

Sending extra data beside or inside a new smart contract

I'm doing a research about Ethereum smart contracts security and I need to send some extra data (for example some json data) beside or inside a new smart contract when I'm deploying that contract on ...
0
votes
0answers
20 views

How do I store or use private keys in node js that I deploy in live server?

I have a live server running a full GETH NODE in which I need to sign a transaction with a private key. The problem is I dont know how I can use the private key without explicitly providing the ...
0
votes
0answers
14 views

Why can only operators transfer between partitions (ERC1400)?

I came across this line in the ERC1400 implementation (by polymath I believe). if (operatorData.length != 0 && data.length >= 64) { toPartition = _getDestinationPartition(fromPartition,...
0
votes
1answer
26 views

Changing transaction validation process in Ethereum

I am doing a research about Ethereum smart contracts security. For this purpose I want to make some changes in Ethereum miner and transactions validation process (editing miner for automatically ...
0
votes
1answer
20 views

Is there any other signature mechanism like ECDSA to verify the signed message if its tampered or not?

I would like to know if there are other signature verification methods other than ECDSA, to verify the message (eg., string, number) signed by a signer. Actually if there are alternative algorithms ...
0
votes
0answers
19 views

Drizzle Dapp on HTTP vs. HTTPS

If I have a Drizzle dap on an http server. Is there a risk that the private keys used with this dapp can be revealed? I suppose this is like asking if a MetaMask interaction within the unsecure http ...
0
votes
1answer
49 views

Lottery Winning number based on blockhash

After reading a lot of Info about this topic in this forum I am asking whether I can just use the formular winningNumber = uint256(blockhash(block.number-1)) % 100; e.g. 10 or 20 blocks after the ...
0
votes
0answers
40 views

what is wrong with this token contract?

This one: https://etherscan.io/address/0xc12d1c73ee7dc3615ba4e37e4abfdbddfa38907e As you can see most of the last transfer fail, the transfer function is: function transfer(address recipient, ...
0
votes
0answers
24 views

Security implications on limiting the round change timeout of Istanbul BFT consensus algorithm?

I have a security-related question regarding the exponentially increasing timeout in the round change, which is used in the Istanbul Byzantine fault-tolerance consensus algorithm used by Quorum. ...
0
votes
0answers
21 views

How to trace transactions to get information about hot and cold wallets?

I am researching ways how to trace transactions to get data about hot and cold wallets of exchanges, gambling sites, cantors, mixers. What sources of data could I use? What algorithms and scripts ...
0
votes
1answer
46 views

Sharing an verifiable secret message in a contract

I would like to hear your opinion on my idea to share a proof of a secret message in a contract, that users can verify later in a second phase when the message will be revealed. If the message is a ...
0
votes
1answer
27 views

Is function like this one reentrant?

Got this in pseudo-code (Solidity like...) from audit of past work of person from our company, in short it seems to be withdrawing first and adding later. Maybe not a good idea, especially since it's ...
0
votes
0answers
16 views

Is function like that prone to reentrancy?

function transfer() payable public returns(bool) { balances[msg.sender] = SafeMath.sub(balances[msg.sender], msg.value); if(msg.sender.call.gas(100000).value(msg.value)()) { ...
0
votes
0answers
339 views

Unable to Unlock Account Even After specifying allow-insecure-unlock

Software: Ubuntu on VirtualBox Update, tried putting two dashes, on allow-insecure-unlock, doesn't work solidity@solidity:~$ geth attach http://127.0.0.1:8545 --allow-insecure-unlock Incorrect Usage:...
0
votes
0answers
17 views

Problem with understanding the solution for Transaction Ordeing Vulnerability

For the following paper, I can’t understand the text written below: https://arxiv.org/pdf/1806.01143.pdf Our violation pattern checks that the amount of the call instruction is determined by a ...
0
votes
0answers
16 views

Backward program analysis (like symbolic backward execution) tools for smart contracts

I know there are some backward program analysis tools for traditional softwares, but i wonder if there are already backward symbolic execution tools for smart contracts, or any tool that I can refer ...
0
votes
1answer
57 views

ERC20 vulnerability? Executing transferFrom undesirably

Say I have a contract called MyContract, and I require to send 100000 DAI to it. Ideally, I'd firstly call approve(<address of A>, 100000e18) in DAI's contract itself. Secondly, I'd execute, for ...
0
votes
2answers
81 views

Is there a way to create double-spending transactions and submit them to different nodes?

I'm trying to create two transactions with the same nonce and send those transactions to two different nodes. Such as: const Web3 = require('web3'); const web3_1 = new Web3(rpcURL1); // node 1 const ...
0
votes
1answer
59 views

How to build security into Dapps?

I am building a loan dapp. The functionality is not easy to build but relatively straightforward. My question is though does anyone have any suggestions of how to build in user logins and security? ...
0
votes
0answers
49 views

Can you verify transaction data by matching it to the transaction hash

TlDr; Can you use the transaction hash to confirm the integrity of the data components of a transaction (post data, addresses, nonce, etc). In my application, I have a connection to the Ethereum ...
0
votes
1answer
71 views

Proxy function clashing - what kind of danger comes exactly with it?

I read that if I am using proxy, there is a chance of function clashing. Let's say in my contract there is a function with a signature: proxyOwner() ...
0
votes
1answer
89 views

User anonymity while submitting data in smart contract

I've written a smart contract, that is a crowd sensing system. Where post posting a task user view that task and if they have what I'm asking for/and meet the task requirements they submit certain ...
0
votes
1answer
13 views

How to restrict call to inherited public function

I'm using OpenZeppelin library for my project and I need to override some functions for business logic. But my concern is with given example, // contract from library contract A { function ...
0
votes
0answers
28 views

Understand the `call` opcode in this contract

Hello, I am posting a quick question regarding the functionality this contract: https://etherscan.io/address/6b63ea3612dde97082aab468157950f927618d31#code From the source code, I am not even able to ...
0
votes
1answer
46 views

Is my function prone to under/overflow?

I don't like using safemath as this is my first conntract and this is getting a bit complicated for me so: function withdraw(uint xyz) public { require(balanceOf[msg.sender] >= xyz); ...
0
votes
1answer
67 views

Is transaction triggered by web3 secure on the internet?

I'm trying to construct my business architecture using ethereum. I'll operate public ethereum node and private business server on the AWS. I'll trigger transaction from the private business server ...
0
votes
1answer
131 views

Security Implications of allowing remote RPC connections to Geth Node

What are the security Implications of allowing remote RPC connections to Geth Node? If one absolutely needs to allow remote rpc connections for web3 connection, how can one do this while securing the ...
0
votes
1answer
232 views

Solidity SafeMath library best practice use cases

I understand why and how to use the SafeMath library. However, I was wondering if there is a kind of best practice guide how and when to use the library and in which cases you don't have to. From a ...
0
votes
0answers
26 views

Storing generated accounts. Security

I originally built a system that had a front end where users simply entered some details and a password which then generated them a wallet and emailed it to them. My aim was that the user could then ...
0
votes
1answer
289 views

Detecting whether a transaction was cancelled (because a block is orphaned)

I'm writing a system where some transactions have to be automatically detected, and wait for 30 blocks to ensure they're confirmed. What I do is that I read all new blocks, and find the transactions ...
0
votes
1answer
123 views

Quorum Consensus - BAR (Byzantine Altruistic Rational) Fault Tolerance / BAR Fault Tolerance / BAR Model

I refer to http://www.cs.utexas.edu/~dahlin/projects/bft/ http://www.cs.cornell.edu/lorenzo/papers/sosp05.pdf http://www.cs.northwestern.edu/~fabianb/classes/cs-443-w07/BAR.pdf https://blog.ethereum....
0
votes
2answers
1k views

Division/Percentages in Solidity (a workaround)

Division/percentages is a required part of many applications but is difficult to implement since fixed and ufixed are not supported yet in Solidity. I've come up with this workaround: pragma ...
0
votes
1answer
341 views

How does Ethereum account state change? [duplicate]

Ethereum uses Accounts instead of UTXO (Bitcoin). I would like to know how does the ledger keep the account state (technical details if possible)? Does it modify the ledger (accounts) by incrementing ...
0
votes
2answers
533 views

Storing Secret in Smart contract [duplicate]

i am currently storing a secret (string) directly inside a smart contract. The idea is that the smart contract only allows authorized people to obtain the secret. The problem is that the smart ...
0
votes
1answer
211 views

Can anyone freely call the `tokenFallback()` function in ERC223?

Since the function seems to always be implemented as public, can't an unfair user just call the tokenFallback() function of a receiver contract? That way one could let contracts believe that they ...
0
votes
0answers
53 views

Hostile Takeover Of Minted Coin In Crowdsale

I am querying the warning on new crowd sales where minted tokens are made as per this guide: https://www.ethereum.org/crowdsale which reads as follows: Once you published the crowdsale contract, get ...
0
votes
0answers
128 views

Where is the security in http provider for a blockchain node IP address?

I have the code below. In testing this actually works but there is no security from what I have seen. The node is at an IP address and the node code just states the default account is coinbase. So ...
0
votes
1answer
488 views

Can a smart contract transfer (steal) another contract's tokens? [duplicate]

Let's say I have an ETH address and that same address holds AAA, BBB and CCC tokens. Each token symbol is managed by a different contract (each contract was created by a different person/organization ...
0
votes
0answers
80 views

Is it possible to get direct access to a contract?

All contracts have addresses. Is it, in theory, possible to find the private key of this address and then get access to this contract? Questions if this is possible: If one gets access to the ...
0
votes
0answers
45 views

What inputs to smart contracts can be maliciously modified by miners, beyond timestamps? Why isn't this caught by mining verification?

Are there other trusted inputs which miners could maliciously modify which still get accepted by blockchain verification? I realize the timestamp can be modified in a small way to potentially modify ...
0
votes
1answer
306 views

Can a smart contract steal ETH?

I know that handing out your private key is like handing over your wallet and say "help yourself", but... if I had register my public ETH address on some unknown smart contract (like sending a "...
0
votes
1answer
212 views

transfer/send error cases

I have a (noob) question on the usage of transfer and send. I have seen that transfer is equivalent to require(x.send(k)); When I use send() I know that I have to check whether there was an error ...
0
votes
1answer
288 views

Threat Model Question - Code Injection / ROP possible in Ethereum Smart Contracts?

I am trying to understand a basic threat model for Ethereum Smart Contracts, to perform some research on how existing attacks techniques may be applied here as well. Is there a risk of a contract with ...
0
votes
1answer
148 views

Are there any security issues to send token in fallback function?

I want to have a contract that releases an erc-20 token as soon as someone pays ether to contract. Let's call this contract Bid Contract. The abstract code goes like: function askForTokens() public ...
0
votes
0answers
85 views

Best practices to calling owner only functions from a website

I am following the web3 documentation and I found that its possible to sign a contract and do a transaction directly from web3. I want to call an onlyOwner function in my contract directly from a ...
0
votes
0answers
182 views

What are the best practices for handling private keys on behalf of dApp users?

I have seen many answers and theory about it but didn't find any concrete example of how it should be done.
0
votes
0answers
40 views

Are functions in contracts visible to everyone who has the block chain?

I have an experience with back end development and I am just getting started with Etherium, but I am a bit confused about something. In Back End development, we mostly assume (if everything goes ...
0
votes
1answer
100 views

How to secure an “unlock”ed address?

I am using Parity and testing a mining pool. In order for the pool to work, I need to specify the --author address on the node running the pool software. I also need to have the payee accounts for ...
0
votes
1answer
42 views

Leverage short positions in decentralised PoW currencies

Hint I asked this question in a similar style already on bitcointalk and on bitcoin.stackexchange. But in these threads, there are no good answers and I thought maybe it would be better to ask the ...

1
8 9 10
11
12