Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
7
votes
1answer
686 views

How much would 51% attack cost?

I was thinking about situation where for example NSA would want to gain control over significant portion of Ethereum network. How much would it cost to for example create mining pool that would be ...
7
votes
3answers
3k views

Storing and passing encrypted data to another owner

I've been thinking about this situation for quite a while and I wonder if there is a way to solve this on the public Ethereum blockchain. User A stores some data on the blockchain, encrypted in some ...
6
votes
3answers
4k views

Blockchain password manager

Is there a blockchain, or a smart contract designed to store user passwords? I am using a proprietary password manager and have hundreds of passwords stored there. I am just a bit worried that the ...
6
votes
2answers
2k views

Generating ethereum address from private key on Ubuntu 32 bit

I have a securely generated private key that I want to use to generate an ethereum address on an offline PC (Ubuntu 32 bit). My preferred way would be to use geth, but there's no geth binary for linux ...
6
votes
3answers
4k views

Is there any API for sending and receiving Ethers?

Is there any API for send and receive Ethers? If not, i am trying to use web3.js in my own server; What are the technical implications? Major security concerns? Can I use the same API for creating ...
6
votes
2answers
1k views

Is it safe to leave your account in an untrusted computer, as long as it is encrypted?

No modern OS is 100% free of viruses or hacking - and, even if it was, people can always just steal your computer. Assuming you can't be safe nobody will access your machine, is it still safe to keep ...
6
votes
5answers
2k views

how to easily transfer ERC20 token from 1000+ accounts which has no ETH in it initially?

I have a requirement to have 1000+ ethereum addresses, which in fact used to store small amounts of various ERC20 tokens. I want to move all these crypto assets in all these 1000+ wallets into a ...
6
votes
2answers
692 views

Is sending some datas in the data field safe?

An airdrop ask to send it 0ETH with 150000 GAS and some datas in DATA field. Is it safe? What could be the aim of this transaction? Thanks.
6
votes
2answers
791 views

What was the second vulnerability used in The DAO attack on 17 June 2016?

From The big theDAO heist FAQ by koeppelmann: How did the attack worked exactly? The attacker managed to combine 2 exploits. The first exploit was to call the split DAO function recursively. That ...
6
votes
1answer
698 views

Read private data of smart contracts from Blockchain

Is there any way to read smart contracts private or internal data from Blockchain? The smart contract data is on Blockchain so probably the data can be read from servers. Is data encrypted on ...
6
votes
3answers
2k views

Personal API documentation for JSON RPC

Is there documentation and examples for using the personal api via JSON-RPC? I found this. However it does not say what the method would be in JSON-RPC.
6
votes
1answer
1k views

Prevent double withdrawal ERC20 API attack

How do I prevent against the double withdrawal attack described in ERC20 API: An Attack Vector on Approve/TransferFrom Methods and initially posted here? An example of the attack: Alice allows ...
6
votes
1answer
635 views

Is address.send() not vulnerable for the recursive call attack?

If my dapp sends ether to another address via the send() method is it not vulnerable for the recursive call attack due to the limited amount of gas of 21000? Or should I still take precautions?
6
votes
1answer
1k views

What does griefing mean?

Not referring to the definition in the dictionary. In the context of blockchains and Ethereum in particular, the term "grief" has been used repeatedly in a host of scenarios: ethresear.ch, Plasma ...
6
votes
1answer
318 views

Any understandable cryptography book/article/lecture to introduce to signatures, hashes, ECDSA etc..? [closed]

It's a long time I'm searching for cryptography lectures related to ethereum inside mechanisms, and everything I found has a high mathematical level. I'm an engineer, not a mathematics, so any article ...
6
votes
1answer
1k views

Only a few peers

Is it normal to be connected only with a few peers (1 to 4, more often 1 than 4)? I think with such a low number of peers, there are security issues. If it is not, is there any way to increase this ...
6
votes
2answers
2k views

Best practices on Token ICO launch

I'm trying to understand how exactly the pre-ICO/ICO should be structured in terms of technical aspect. What are there trustworthy things that every ICO developer should think about. I'm interested ...
6
votes
1answer
1k views

Accessibility of public variables

If I have a public state variable, does this mean that other contracts can access or even change its value? I have made a cryptocoin from here and all variables are declared as public, so I am ...
6
votes
2answers
350 views

What are the most important potential attack vectors on oracles?

Specifically, with my question I want to target Oracelize.it as arguably the most "state of the art" oracle service. This specification is done in order to exclude trivial attacks in the potential ...
6
votes
1answer
2k views

How does a fallback function rejecting ether work?

A contract in Solidity can have a fallback function like: // This contract rejects any Ether sent to it. It is good // practise to include such a function for every contract // in order not to loose ...
6
votes
2answers
1k views

How does web3.js verify that it is geth that is listening on port 8545?

With several web applications emerging that are essentially front-ends to dapps, there are RPC calls being made to localhost port 8545 (ostensibly by web3.js running in the web client). These local ...
6
votes
1answer
243 views

Is there a way to reproduce a stack depth attack now?

I am trying to replicate the attack I found here: Reproducing stack depth attack contract Attacker { Victim public victimContract; uint x; function Attacker(){ victimContract = (new Victim)....
6
votes
1answer
73 views

Have the curators emptied the whitelist of all splits after the 17 June attack?

Would like to understand if an imitator attack is possible in the next days? Explain if the split list of MEW https://www.myetherwallet.com/#dao-proposals reflects the whitelisting. Explain if splits ...
5
votes
4answers
544 views

In simple terms, how did the DAO get hacked and funds removed from it?

How did the DAO get hacked? Can someone explain in simple terms?
5
votes
1answer
1k views

Solidity - Can an attacker call private functions?

Looking around I found Solidity functions - private visibility but not an answer to my specific question. Basically my question is: is the private keyword enforced at the Solidity language level or ...
5
votes
2answers
2k views

Honest lottery winner generation - pseudo random number obtaining

Suppose I would like to organize a honest lottery and prevent cheating when we need to find a winner. I known problem of random number in the known network arises. I would like to try the following ...
5
votes
3answers
1k views

Dealing with the short address attack

I'm writing a contract for an ERC20 token, based on Zepellin contracts. I noticed that their code doesn't handle the short address attack. Does it mean I shouldn't care about it?
5
votes
1answer
410 views

What is the proof that Mainnet can't be reset?

It has been argued that the Morden testnet can be reset any time. How can one verify that this is not possible with the mainnet?
5
votes
1answer
210 views

How to jump to any arbitrary location in already deployed contracts

I’d like to know what is preventing me to write an assembly code who knows the contract address and call some arbitrary functions, even if declared “internal” via a simple JUMP. In theory I can: 1) ...
5
votes
2answers
307 views

Does ethereum clients return false data if someone manipulate local blockchain data?

If someone manipulates the local blockchain data, does ethereum clients like geth return false data? For example, after cracker manipulates local blockchain files or leveldb, does geth return ...
5
votes
2answers
369 views

Can the stalker attack in TheDAO be stopped?

https://github.com/slockit/dao/wiki/Why-The-Stalker-attack-is-a-non-issue#a-way-to-guarantee-you-get-your-eth says: Assuming the attacker also voted yes in all of the new Curator Proposals, in ...
5
votes
1answer
383 views

Ethereum metadata limit

Couple of days ago Vitalik Buterin tweeted that Ethereum has no metadata limit. Is that true? Two major questions that bothers me, as a developer: I can store any amount of data inside contacts? ...
5
votes
2answers
445 views

Is it safe to generate an account with 256 coin flips?

Suppose one generates an account with the following procedure: Flip a coin 256 times; On a paper, write each heads as 1 and each tails as 0; Convert the 256-bit string to hex by mapping each 4-bit ...
5
votes
1answer
125 views

Who keeps the Ether when a transaction triggers an exception?

An audit had "Strong Recommendation: We recommend that exceptions cause all value to be returned to the sender, not the recipient." What were the technical reasons for not implementing this ...
5
votes
1answer
263 views

Can I make a “secret” invite only Smart Contract?

I have a public smart contract where I am able to make a secret and hash it within the contract. I then share the "secret" with N number of my friends and with the secret they can create a new hash (...
5
votes
1answer
119 views

Is it possible to use negative gas to execute a Reentrant attack using .send()?

Haven't tested it out but I think in theory this could work. It might work somehing like this: An attacker first writes a lot of data to storage so there is data to be deleted. Using .send() in the ...
5
votes
1answer
101 views

Implementing a card game, how to keep the dealt cards secure?

Hello I am a novice with ethereum and encryption... If i would implement a cardgame in ethereum, i jave to deal cards to users. I think this can be done by encrypting the cards by the players' public ...
5
votes
1answer
151 views

How trustless and secure are Events?

How trustless and secure are Events? They are part of the consensus as they are generated out of a smart contract code. so in theory they are trustless and secure. But they are not stored on chain or ...
5
votes
2answers
236 views

How can we find “the DAO” attacker on 17 June 2016?

This question is about the level of anonymity in the system. I would like to know how anonymous one can be at this ecosystem? In other words, is it possible to track down an individual responsible ...
5
votes
1answer
114 views

Validating a contract before sending ethers to it

This is a partially philosophical question, by an Ethereum newbie. When calling a contract, you send ethers to it. Before that, you checked of course that the contract does something interesting/...
5
votes
1answer
286 views

Security of PoS if/when Assets (Tracked or Native) to Ethereum exceed the total Value of Ether

Given that Ethereum naturally allows for the creation of arbitrary tokens that can either have value themselves or track a real-world asset, can Ethereum be secured by PoW/PoS when the total assets on ...
5
votes
1answer
277 views

Can I import my wallet into more than one computer?

Is it safe & secure to import my wallet into multiple Ethereum clients?
5
votes
1answer
97 views

Why is the subcall gas limit set to 63/64th of the remaining gas?

From the solidity docs: Calls are limited to a depth of 1024, which means that for more complex operations, loops should be preferred over recursive calls. Furthermore, only 63/64th of the gas can ...
5
votes
1answer
253 views

Are Monolithic Smart Contracts Better than Those That Are Decoupled?

The smart contract app I am writing follows what I consider good practice - it is decoupled so that a controller contract calls a logic contract which calls a storage contract. So Contract A calls ...
5
votes
1answer
62 views

ENS refinement before deployment (Swaldman catch)

User @Swaldman made a great catch today and found a bug in ENS auction code: https://github.com/ethereum/ens/issues/49 What are the various ways to fix/prevent this attack vector before deployment?
5
votes
1answer
401 views

How to protect against DELEGATECALL in a hub-spoke contract model?

Say I have a "master" contract that can create other "servant" contracts. The master contract routes users into different servant contracts and each servant contract should only be able to be accessed ...
5
votes
1answer
111 views

Resilience to rogue miners

How will Ethereum stop evil-miner attacks where a gas-guzzling tx is added to a just-solved block to slow down competition once gasLimit goes high ? For relevant discussion see this reddit thread, ...
4
votes
1answer
413 views

What's the vulnerability in my contract?

I've got a contract deployed at 0xe559835D7979dAe994331DEfaEc2FBA057E56C27 on the mainnet. Every time I go to call the payable function, which is solve, a bot beats me to it. My transaction gets ...
4
votes
2answers
789 views

Why and how does the “low security” functions affect the biggest multi signature contract?

People use this contract everyday http://github.com/ethereum/dapp-bin/blob/master/wallet/wallet.sol and it's also the contract with most ethereums right now. Also you can create a multisig account on ...
4
votes
1answer
2k views

Node's IP exposed

I've run an Ethereum full node using Geth. I want to know if my public IP is exposed? Could hackers target my machine through the Internet?

1 2
3
4 5
12