Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
11
votes
4answers
1k views

“potential rewrite attack” message on Geth

When I was sending Ether using Mist I got the following message on Geth. I0528 18:34:57.312997 core/blockchain.go:959] imported 1 block(s) (0 queued 0 ignored) including 3 txs in 19.344963ms. #...
11
votes
2answers
343 views

Does a light client require a chain of trust towards full nodes?

A full client does not need to trust any individual node on the Ethereum network, as the full client can see the activity from all nodes and discard any inconsistencies caused by ill intentioned nodes ...
11
votes
1answer
3k views

Can I unlock an account using JSON-RPC?

The only way I can work with ETH is through --rpc mode. Normally I would prefer to use the Python interface. But I found myself in a situation where the RPC is very limited. For example, I can't ...
11
votes
2answers
204 views

How dependent is the ethereum client on the router and DNS being trusted?

Another way to put it: what is the root of trust for a full client on a network that has a potentially untrusted (or "owned") router+DNS? As I was going through the ethereum wiki semi-randomly, I ...
10
votes
1answer
2k views

Why does Ethereum require use of UDP (and not TCP) for discovery?

I am aware of the advantages of UDP, but why not allow a choice? Since since Tor requires the use of TCP, why have Ethereum developers elected not to support TCP for discovery?
10
votes
1answer
161 views

Is it dangerous to name my function ccccvKygDv?

For those keeping track at home, the function hash of a function named ccccvKygDv() is 0xffffffff, the same as a null address. pragma solidity ^0.4.0; contract NullFunction { function ccccvKygDv()...
9
votes
1answer
7k views

Security measures to overcome 51% attack

I was reading During a 51% attack, What Can the Attacker Actually Accomplish? from there, i understand the after-effects are something serious, so what are the security measures which ethereum have ...
9
votes
3answers
1k views

Can you attack/ddos/spam a single contract?

Can you make a denial of service attack against a Contract? By blocking a single contract (or ethereum-object) instance so it can't be executed? For example spamming it in some way, like repeadetly ...
9
votes
1answer
3k views

How to steal eth using delegatecall and selfdestruct

This documentation says Even if a contract’s code does not contain a call to selfdestruct, it can still perform that operation using delegatecall or callcode. This worries me. I've created ...
9
votes
4answers
3k views

Geth RPC connections securely

I have read everywhere that exposing personal over rpc is dangerous and is vulnerable. The question is HOW? Is it possible for anyone to send transactions to my geth console, if my ipaddress and port ...
9
votes
2answers
5k views

Solidity functions - private visibility

Is the following function parameter (string name) only visible to the owner contract itself? function myFunction(string name) private returns (bool) { return true; } So nobody can read / see ...
9
votes
1answer
2k views

Is it safe to publicly host a parity node?

In the normal use case, Parity runs on localhost. However, I'm building a demo web site that uses Web3JS to connect to a public parity node running on port 8545. I am publicly serving a Node/VueJS ...
9
votes
1answer
832 views

How many ethers have been drained through the recursive call attacks on The DAO?

The recursive call attacks on The DAO have now stopped as there are no more ethers in The DAO account. What are the amounts and percentages that can be attributed to the hostile and friendly attacks, ...
9
votes
1answer
854 views

What about illegal smart contracts?

Trying to get a friend excited about smart contracts I referred him to an ethereum pyramid scheme as an easy to understand example but he only pointed out that all pyramid schemes are illegal. How ...
9
votes
2answers
3k views

Storing private data on the ethereum blockchain

I plan to make an app utilising Ethereum that will store private data about a user. Eventually, I want this data to be accessible by selected users. I have seen conflicting answers & discussions ...
9
votes
1answer
654 views

What data will zk-SNARKs protect?

Implementing zk-SNARKs is planned in Ethereum roadmap, what data will be obfuscated? transaction sender and receiver? data in transactions? data stored in contracts? variables and methods in ...
9
votes
2answers
2k views

Persistent “deep transaction reorg” whilst syncing full geth node

Whilst syncing a new full node using the geth comand "geth --syncmode full", every other line after a few hundred blocks I see the following: WARN [12-02|02:30:46] Skipping deep transaction reorg ...
8
votes
7answers
3k views

Security analysis tool for Ethereum smart contracts

I'm looking for the best value affordable code checkers to find vulnerabilities in solidity code. I came across on Mythril[1] but I wonder which other products are used. [1] https://github.com/b-...
8
votes
1answer
5k views

How to unlock accounts programmatically after the node has started?

Is there any way of just unlocking accounts without opening the console with geth? I'm writing some scripts to automate cluster generation and I wish I could just call geth to unlocking some accounts ...
8
votes
2answers
2k views

Could Malware Be Stored in the Blockchain

So if my computer downloads and maybe reads the whole block chain can there be viruses etc. stored within the blockchain/dapps?
8
votes
3answers
1k views

Is there a point to hide Ethereum nodes with TOR?

From a privacy perspective, is there any point in trying to torify ethereum nodes? I know there's a script to do that in bitcoin, although doing so may ironically made the bitcoin node more ...
8
votes
1answer
2k views

How should I secure a private key in my dapp?

We are currently building an app that interacts with the blockchain. It needs to be able to make transactions on the blockchain on it's own - for instance to add addresses to a whitelist. This means ...
8
votes
5answers
929 views

What are legitimate uses of tx.origin?

It is known that msg.sender must be used for authentication instead of tx.origin (the difference explained here). Some static analysis tools (e.g., in Remix) detect all usages of tx.origin as ...
8
votes
1answer
1k views

How many The DAO recursive call vulnerability attacks have occurred to date?

The first identified The DAO recursive call vulnerability attack occurred on 17 June 2016, with the accounts identified in Which accounts are involved in mounting the recursive call vulnerability ...
8
votes
1answer
2k views

Callstack attack

If my contract has a payout function like this address bossAddress; address employeeAddress; uint256 bossSalary; uint256 employeeSalary; function payout (){ if (msg.sender==bossAddress){ ...
8
votes
3answers
416 views

Why isn't the DAO attack repeated, after the first proof that it works?

As of 18 June no hacker repeated the DAO attack, even if for a certain time (until the network is spammed and the recursion is stopped) the hack would work the same way the first attack worked. What ...
8
votes
1answer
561 views

Testnet First Transaction Nonce

I'm implementing a back end with different Ethereum features. I need to be able to create raw transactions. I've successfully did it using Web3 sendRawTransaction from Node.JS, but I wonder how should ...
8
votes
2answers
259 views

Could parasite contracts cripple the Ethereum ecosystem?

This critique of Ethereum presents leeching Parasite Contracts as a problem. A Parasite Contract accesses data from other contracts (which may be charging fees for the data), and offers the same data ...
8
votes
1answer
611 views

Is there a recommended / secure way to unlock an account through Web3 interface / HTML page securely?

This question was asked on Reddit: Is there a secure/recommended solution to unlock an account and send a tx through the Web3 interface (from a Html page)? One of the alternatives that I have in mind ...
8
votes
1answer
475 views

Ethereum mining pool centralization

There are a number of well known undesirable effects of mining pool centralization, primarily: increased risk of collusion a small set of pools effectively gain veto power on the evolution of the ...
8
votes
1answer
248 views

Is ethereumwallet.com generating the keys client-side?

Is ethereumwallet.com generating the all the keys, accounts and transactions client-side? Is it legit and safe to use? Is it possible to confirm the javascript has no backdoors? Can it be trusted?
8
votes
2answers
863 views

Can msg.data be used as an identifier?

I'm looking at the multisig wallet implementation here and I see the usage of sha3(msg.data,block.number) being used as an identifier. What exactly is inside the msg.data and why is it unique enough ...
8
votes
1answer
494 views

Will Whisper work with Ethereum contracts, or should I try another way for sending secrets?

I'd like for someone calling a contract to be able to send me secret info. Lets say it's just the person's physical address because they bought something from me. They don't want to just put that info ...
7
votes
2answers
2k views

What are the best practices to keep your ethereum smart contract code from being copied and reused?

I'm new to smart contract development. I have built a couple of sample projects and deployed those to my private network. So now I am doing some research on best practices in regards to smart contract ...
7
votes
3answers
1k views

List of all smart contract based attacks?

Do you know of a list/blog/webiste with all attacks that occurred against smart contracts?
7
votes
2answers
1k views

What is a Sybil attack?

The term "Sybil Attack" comes up often when discussing network security with researchers. What is it? How much of a concern is it to the Ethereum network? What are some effective ways to prevent it?
7
votes
2answers
582 views

How does the system enforce correct execution of smart contracts?

If I understand correctly, the smart contracts are run by the miners. What incentive do the miners have to execute the smart contracts correctly? What stops a malicious miner from changing the result, ...
7
votes
4answers
457 views

How to prove that a user owns their public key for free?

If a user claims to own a public key is there a way that I can query metamask or a web3 object and say "hey this guy is telling me that he owns this public key is that true?" I could ask the user to ...
7
votes
1answer
1k views

Demystify Transaction signing process

Can someone explain in layman term, why the transaction needs to be signed and the role of public key, private key in transaction signing process. From what I have read so far: When user creates a ...
7
votes
2answers
2k views

How did they stop “the DAO” attack on 17 June 2016? [duplicate]

Is it possible to prevent some transactions from happening? Obviously not, since it will ruin the whole purpose of having a decentralized system. So my question is how could they stop the attack? In ...
7
votes
2answers
1k views

How was the recursion created that lead to theDAO hack?

I understand that if theDAO contract has a withdrawal function that sends money to contract X - contract X can be malicious and use the fallback function to call the withdrawal function again. However ...
7
votes
1answer
2k views

What is Geth's JIT VM?

Whilst downloading the blockchain which has taken me approximately a week to get to block 1.09 mil, I received a message from geth.exe after a reboot around 1050999 -1060888 You're one of the lucky ...
7
votes
1answer
785 views

How does Ethereum avoid mining pool centralization?

As a proof-of-work (PoW) based blockchain, how does Ethereum combat mining pool centralization, which can lead to an entity controlling the majority of hashing power?
7
votes
1answer
148 views

Is a suiciding contract susceptible to re-entrancy?

If my contract calls suicide() referencing a contract as the recipient of funds, and that recipient contract default function calls back into my contract, will the call succeed? contract A { ...
7
votes
1answer
194 views

How to get started after participating in the presale?

I participated in the Ethereum presale and have my wallet stored safely in my password manager. Then I stepped away from all things ethereum for a couple years. Now I'm ready to get back into it. I ...
7
votes
1answer
265 views

Ethereum walk-through

Would the following story line be a fair approximation of how Ethereum would work in this simplistic scenario? Simple network with just three nodes: N1, N2 and N3 N1 writes a contract that initiates ...
7
votes
1answer
658 views

How much would 51% attack cost?

I was thinking about situation where for example NSA would want to gain control over significant portion of Ethereum network. How much would it cost to for example create mining pool that would be ...
7
votes
3answers
3k views

Storing and passing encrypted data to another owner

I've been thinking about this situation for quite a while and I wonder if there is a way to solve this on the public Ethereum blockchain. User A stores some data on the blockchain, encrypted in some ...
6
votes
3answers
3k views

Blockchain password manager

Is there a blockchain, or a smart contract designed to store user passwords? I am using a proprietary password manager and have hundreds of passwords stored there. I am just a bit worried that the ...
6
votes
2answers
2k views

Generating ethereum address from private key on Ubuntu 32 bit

I have a securely generated private key that I want to use to generate an ethereum address on an offline PC (Ubuntu 32 bit). My preferred way would be to use geth, but there's no geth binary for linux ...

1
2
3 4 5
11