Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
6
votes
2answers
2k views

Generating ethereum address from private key on Ubuntu 32 bit

I have a securely generated private key that I want to use to generate an ethereum address on an offline PC (Ubuntu 32 bit). My preferred way would be to use geth, but there's no geth binary for linux ...
6
votes
3answers
4k views

Is there any API for sending and receiving Ethers?

Is there any API for send and receive Ethers? If not, i am trying to use web3.js in my own server; What are the technical implications? Major security concerns? Can I use the same API for creating ...
6
votes
2answers
1k views

Is it safe to leave your account in an untrusted computer, as long as it is encrypted?

No modern OS is 100% free of viruses or hacking - and, even if it was, people can always just steal your computer. Assuming you can't be safe nobody will access your machine, is it still safe to keep ...
6
votes
2answers
613 views

Is sending some datas in the data field safe?

An airdrop ask to send it 0ETH with 150000 GAS and some datas in DATA field. Is it safe? What could be the aim of this transaction? Thanks.
6
votes
1answer
2k views

Will revert() refund all gas of the transaction or just the remaining gas?

According to the docs revert() will not consume any gas: Note that assert-style exceptions consume all gas available to the call, while revert-style exceptions will not consume any gas starting ...
6
votes
1answer
1k views

Is transfer() still safe after the Istanbul update?

In other words, is using transfer() safe? function transfer(address contractB) public { contractB.transfer(1000); //balances[msg.sender] -= 1000; } How about using call.gas? function ...
6
votes
1answer
691 views

Read private data of smart contracts from Blockchain

Is there any way to read smart contracts private or internal data from Blockchain? The smart contract data is on Blockchain so probably the data can be read from servers. Is data encrypted on ...
6
votes
3answers
2k views

Personal API documentation for JSON RPC

Is there documentation and examples for using the personal api via JSON-RPC? I found this. However it does not say what the method would be in JSON-RPC.
6
votes
1answer
982 views

Prevent double withdrawal ERC20 API attack

How do I prevent against the double withdrawal attack described in ERC20 API: An Attack Vector on Approve/TransferFrom Methods and initially posted here? An example of the attack: Alice allows ...
6
votes
1answer
632 views

Is address.send() not vulnerable for the recursive call attack?

If my dapp sends ether to another address via the send() method is it not vulnerable for the recursive call attack due to the limited amount of gas of 21000? Or should I still take precautions?
6
votes
1answer
867 views

What does griefing mean?

Not referring to the definition in the dictionary. In the context of blockchains and Ethereum in particular, the term "grief" has been used repeatedly in a host of scenarios: ethresear.ch, Plasma ...
6
votes
1answer
296 views

Any understandable cryptography book/article/lecture to introduce to signatures, hashes, ECDSA etc..? [closed]

It's a long time I'm searching for cryptography lectures related to ethereum inside mechanisms, and everything I found has a high mathematical level. I'm an engineer, not a mathematics, so any article ...
6
votes
1answer
1k views

Only a few peers

Is it normal to be connected only with a few peers (1 to 4, more often 1 than 4)? I think with such a low number of peers, there are security issues. If it is not, is there any way to increase this ...
6
votes
2answers
2k views

Best practices on Token ICO launch

I'm trying to understand how exactly the pre-ICO/ICO should be structured in terms of technical aspect. What are there trustworthy things that every ICO developer should think about. I'm interested ...
6
votes
1answer
988 views

Accessibility of public variables

If I have a public state variable, does this mean that other contracts can access or even change its value? I have made a cryptocoin from here and all variables are declared as public, so I am ...
6
votes
2answers
328 views

What are the most important potential attack vectors on oracles?

Specifically, with my question I want to target Oracelize.it as arguably the most "state of the art" oracle service. This specification is done in order to exclude trivial attacks in the potential ...
6
votes
1answer
2k views

How does a fallback function rejecting ether work?

A contract in Solidity can have a fallback function like: // This contract rejects any Ether sent to it. It is good // practise to include such a function for every contract // in order not to loose ...
6
votes
2answers
1k views

How does web3.js verify that it is geth that is listening on port 8545?

With several web applications emerging that are essentially front-ends to dapps, there are RPC calls being made to localhost port 8545 (ostensibly by web3.js running in the web client). These local ...
6
votes
1answer
228 views

Is there a way to reproduce a stack depth attack now?

I am trying to replicate the attack I found here: Reproducing stack depth attack contract Attacker { Victim public victimContract; uint x; function Attacker(){ victimContract = (new Victim)....
6
votes
1answer
73 views

Have the curators emptied the whitelist of all splits after the 17 June attack?

Would like to understand if an imitator attack is possible in the next days? Explain if the split list of MEW https://www.myetherwallet.com/#dao-proposals reflects the whitelisting. Explain if splits ...
5
votes
4answers
540 views

In simple terms, how did the DAO get hacked and funds removed from it?

How did the DAO get hacked? Can someone explain in simple terms?
5
votes
5answers
1k views

how to easily transfer ERC20 token from 1000+ accounts which has no ETH in it initially?

I have a requirement to have 1000+ ethereum addresses, which in fact used to store small amounts of various ERC20 tokens. I want to move all these crypto assets in all these 1000+ wallets into a ...
5
votes
1answer
1k views

Solidity - Can an attacker call private functions?

Looking around I found Solidity functions - private visibility but not an answer to my specific question. Basically my question is: is the private keyword enforced at the Solidity language level or ...
5
votes
2answers
770 views

What was the second vulnerability used in The DAO attack on 17 June 2016?

From The big theDAO heist FAQ by koeppelmann: How did the attack worked exactly? The attacker managed to combine 2 exploits. The first exploit was to call the split DAO function recursively. That ...
5
votes
2answers
2k views

Honest lottery winner generation - pseudo random number obtaining

Suppose I would like to organize a honest lottery and prevent cheating when we need to find a winner. I known problem of random number in the known network arises. I would like to try the following ...
5
votes
3answers
947 views

Dealing with the short address attack

I'm writing a contract for an ERC20 token, based on Zepellin contracts. I noticed that their code doesn't handle the short address attack. Does it mean I shouldn't care about it?
5
votes
1answer
404 views

What is the proof that Mainnet can't be reset?

It has been argued that the Morden testnet can be reset any time. How can one verify that this is not possible with the mainnet?
5
votes
1answer
176 views

How to jump to any arbitrary location in already deployed contracts

I’d like to know what is preventing me to write an assembly code who knows the contract address and call some arbitrary functions, even if declared “internal” via a simple JUMP. In theory I can: 1) ...
5
votes
2answers
306 views

Does ethereum clients return false data if someone manipulate local blockchain data?

If someone manipulates the local blockchain data, does ethereum clients like geth return false data? For example, after cracker manipulates local blockchain files or leveldb, does geth return ...
5
votes
2answers
345 views

Can the stalker attack in TheDAO be stopped?

https://github.com/slockit/dao/wiki/Why-The-Stalker-attack-is-a-non-issue#a-way-to-guarantee-you-get-your-eth says: Assuming the attacker also voted yes in all of the new Curator Proposals, in ...
5
votes
1answer
353 views

Ethereum metadata limit

Couple of days ago Vitalik Buterin tweeted that Ethereum has no metadata limit. Is that true? Two major questions that bothers me, as a developer: I can store any amount of data inside contacts? ...
5
votes
2answers
415 views

Is it safe to generate an account with 256 coin flips?

Suppose one generates an account with the following procedure: Flip a coin 256 times; On a paper, write each heads as 1 and each tails as 0; Convert the 256-bit string to hex by mapping each 4-bit ...
5
votes
1answer
125 views

Who keeps the Ether when a transaction triggers an exception?

An audit had "Strong Recommendation: We recommend that exceptions cause all value to be returned to the sender, not the recipient." What were the technical reasons for not implementing this ...
5
votes
1answer
246 views

Can I make a “secret” invite only Smart Contract?

I have a public smart contract where I am able to make a secret and hash it within the contract. I then share the "secret" with N number of my friends and with the secret they can create a new hash (...
5
votes
1answer
116 views

Is it possible to use negative gas to execute a Reentrant attack using .send()?

Haven't tested it out but I think in theory this could work. It might work somehing like this: An attacker first writes a lot of data to storage so there is data to be deleted. Using .send() in the ...
5
votes
1answer
98 views

Implementing a card game, how to keep the dealt cards secure?

Hello I am a novice with ethereum and encryption... If i would implement a cardgame in ethereum, i jave to deal cards to users. I think this can be done by encrypting the cards by the players' public ...
5
votes
1answer
133 views

How trustless and secure are Events?

How trustless and secure are Events? They are part of the consensus as they are generated out of a smart contract code. so in theory they are trustless and secure. But they are not stored on chain or ...
5
votes
2answers
235 views

How can we find “the DAO” attacker on 17 June 2016?

This question is about the level of anonymity in the system. I would like to know how anonymous one can be at this ecosystem? In other words, is it possible to track down an individual responsible ...
5
votes
1answer
113 views

Validating a contract before sending ethers to it

This is a partially philosophical question, by an Ethereum newbie. When calling a contract, you send ethers to it. Before that, you checked of course that the contract does something interesting/...
5
votes
1answer
65 views

Why is the subcall gas limit set to 63/64th of the remaining gas?

From the solidity docs: Calls are limited to a depth of 1024, which means that for more complex operations, loops should be preferred over recursive calls. Furthermore, only 63/64th of the gas can ...
5
votes
1answer
248 views

Are Monolithic Smart Contracts Better than Those That Are Decoupled?

The smart contract app I am writing follows what I consider good practice - it is decoupled so that a controller contract calls a logic contract which calls a storage contract. So Contract A calls ...
5
votes
1answer
62 views

ENS refinement before deployment (Swaldman catch)

User @Swaldman made a great catch today and found a bug in ENS auction code: https://github.com/ethereum/ens/issues/49 What are the various ways to fix/prevent this attack vector before deployment?
5
votes
1answer
393 views

How to protect against DELEGATECALL in a hub-spoke contract model?

Say I have a "master" contract that can create other "servant" contracts. The master contract routes users into different servant contracts and each servant contract should only be able to be accessed ...
5
votes
1answer
110 views

Resilience to rogue miners

How will Ethereum stop evil-miner attacks where a gas-guzzling tx is added to a just-solved block to slow down competition once gasLimit goes high ? For relevant discussion see this reddit thread, ...
4
votes
2answers
783 views

Why and how does the “low security” functions affect the biggest multi signature contract?

People use this contract everyday http://github.com/ethereum/dapp-bin/blob/master/wallet/wallet.sol and it's also the contract with most ethereums right now. Also you can create a multisig account on ...
4
votes
1answer
2k views

Node's IP exposed

I've run an Ethereum full node using Geth. I want to know if my public IP is exposed? Could hackers target my machine through the Internet?
4
votes
2answers
402 views

Reproducing stack depth attack

Victim contract allows one time withdraw only. I want to attack it using stack depth attack to withdraw everything it has. I've tried different things, but can't get the desired result. Here's where I'...
4
votes
2answers
2k views

How do I delete the geth console history?

how do I delete the geth console history ? I'm concerned with this, especially in light of this recent Mist hack : On the console you can also unlock accounts (one at a time). personal....
4
votes
2answers
2k views

Smallest number of nodes for an Ethereum private blockchain

In a public instance, one would expect the more miners the merrier, as this improves the overall mining diversity and therefore we get better security. Private blockchains, as in the Eris case, tend ...
4
votes
1answer
1k views

How to create a “cold wallet” and is it really necessary? [duplicate]

What's up everyone. I have a decent amount of Ether and I want to protect it as much as possible. I read that basically the only way someone could hack an ETH account would be with a keylogger program....

1 2
3
4 5
11