Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
4
votes
2answers
2k views

Smallest number of nodes for an Ethereum private blockchain

In a public instance, one would expect the more miners the merrier, as this improves the overall mining diversity and therefore we get better security. Private blockchains, as in the Eris case, tend ...
4
votes
1answer
1k views

How to create a “cold wallet” and is it really necessary? [duplicate]

What's up everyone. I have a decent amount of Ether and I want to protect it as much as possible. I read that basically the only way someone could hack an ETH account would be with a keylogger program....
4
votes
2answers
2k views

Unlocking accounts for a back office app

I'm writing a "back office" app and need a way to unlock an account in an automated fashion. Yes, I know security of nodejs is questionable, but there are ways of solving this. blocking web3 from ...
4
votes
1answer
138 views

Underhanded Solidity: Exploiting multiple inheritance

In an article by Steve Marx (on Medium.com), the author argues against using inheritance in solidity not only because of harder readability of a Smart Contract, but also because it can be exploited in ...
4
votes
1answer
348 views

What are the best practices when setting up / interacting with a hot wallet on an application server?

Let's say I have a small application running on a server that interacts with the Ethereum blockchain to occasionally send ETH to random addresses at random times. This application also has other ...
4
votes
1answer
501 views

Is the content of a function and the data in a smart contract publicly readable?

When I create a smart contract with some functions in it, I know anyone can execute those functions. My question is; can anyone also read the source/logic of those functions? And I've got the same ...
4
votes
1answer
965 views

Transaction receipts, blocks and confirmations

In Bitcoin, there is a best practice to wait between three to six block confirmations before accepting an transaction. This is to avoid double spending. Are there similar rules of thumb in Ethereum? ...
4
votes
1answer
121 views

Did the spamming counter-attack on The DAO attack work to slow down the attacks?

This question was asked in the comment section of What does TheDAO counter-attack by spamming actually do? (suggested by Stephan Tual). Background links: The attacks used a recursive call ...
4
votes
1answer
194 views

Is having an open TCP port dangerous (Mac OSX)?

I was reading this post on reddit where a user got all her ether hacked because she had an open RCP port when deploying a contract. I just used network utility to run a scan and it turns out I have ...
4
votes
1answer
272 views

ERC20 transfer - caller expects return but none provided - what happens?

If someone implements the ERC20 transfer() function without the return value as follows: function transfer(address to, uint256 value) public { require( ... usual checks ... ); balances_[msg....
4
votes
1answer
118 views

Can an Ethereum key generated on a laptop be brute-forced by someone else because of low entropy?

I read this and this tweets. Though, I understand that this issue occur because some people use the same private key mentioned in a blog/forum. But, on the first tweet, people were talking about the ...
4
votes
1answer
238 views

Does the recent attack to “the DAO” means end of it? [duplicate]

However implementing the DAO and its smart contracts are incredibly exciting experiments, the recent attack to the DAO clearly suggested that the code is not safe and may or may not have more ...
4
votes
1answer
182 views

Trustlessness and Provability in DApp design

I am looking for suggestions or references on how to build proper trustlessness and provability into my DApps. These are DApp distinctives, but I find that thinking this through is like peeling back ...
4
votes
2answers
169 views

When a bonded node loses a bet who gets the ETH?

In Casper Proof-of-Stake, a validator needs to be a bonded node: it puts up a security deposit that can be lost if the validator misbehaves. When a bonded node misbehaves, who receives the lost ETH?
4
votes
1answer
402 views

Why doesn't Ethereum do double hashing like Bitcoin?

Why doesn't Ethereum do double hashing like Bitcoin? What are the facts or theories on the security of single Keccak-256 hashing like Ethereum, as compared to Bitcoin's double hashing with SHA2-256? ...
4
votes
1answer
274 views

Security of PoS if/when Assets (Tracked or Native) to Ethereum exceed the total Value of Ether

Given that Ethereum naturally allows for the creation of arbitrary tokens that can either have value themselves or track a real-world asset, can Ethereum be secured by PoW/PoS when the total assets on ...
4
votes
1answer
274 views

Can I import my wallet into more than one computer?

Is it safe & secure to import my wallet into multiple Ethereum clients?
4
votes
1answer
159 views

What is the “pre-commit” scheme to defeat frontrunning attack?

I am writing to inquire feasible strategies to defeat Transaction Ordering Dependence (TOD) bugs. I learned from the best practice guideline such that we can use a so-called "pre-committed" scheme ...
4
votes
1answer
146 views

Malicious smart contract and stolen tokens from other contracts?

I'm wondering if by interacting with a contract, it could affect my ETH or tokens on other contracts. I'm asking because I'm seeing many EOS airdrops on ethereum that require us to send a 0 ETH ...
4
votes
1answer
284 views

Does a greater number of hashing rounds in aes-128-ctr scrypt key generation mean stronger encryption?

Consider the following Ethereum account I created at MyEtherWallet: { version: 3, id: '4447b704-e28c-4e93-8b1d-32f519b46692', address: '115312fc0ab77a0fb15a66baf51f58baefcee1dd', Crypto: { ...
4
votes
1answer
364 views

What to do with smart contracts to avoid replay attacks?

I am trying to write a smart contract for Crowdsale. What extra measures should one keep in mind during smart contract development to avoid replay attacks (after the hard fork of block 1,920,000)?
4
votes
1answer
312 views

Why exposing the personal API is unsafe?

From what I am reading in various places such as here ,here or here, it is not safe to expose the personal api to the front-end Dapp via RPC. Hence asking the users to run geth --rpc --rpcapi "eth,...
4
votes
2answers
891 views

How is the keccak256(a, b) function implemented?

I need to understand how keccak256(a, b) is implemented and how it differs from keccak256(a || b). Is the content padded? I need this because I do not want to allow for vulnerabilities where a user ...
4
votes
1answer
114 views

How to prevent an attack on a contract creation service

Say there is a smart contract that involves a buyer and seller. Anyone can instantiate this contract but eventually two parties, the buyer and seller, will register with the contract. A seller would ...
4
votes
3answers
639 views

ClamAV finds eicar in chaindata ldb and quarantines file

What would happen if one of the .ldb files from the mist chaindata was deleted, i.e. /Users/yourname/Library/Ethereum/chaindata/060540.ldb was removed. One of the ClamAV engines found a test virus ...
4
votes
0answers
127 views

How is Casper better than POW against possible government censorship? [closed]

As of now my understanding is that with POW an attack by one or multiple goverments could be orchestrated just by raiding mining farms (which can be easily identified given the electricity bill) and ...
3
votes
7answers
3k views

Are there any tools that provide security reviews of Solidity code?

Do we have any standardized security scanning tool to go for security code review for solidity language? If not, what all opensource tools are there on which we can relay? Need response urgently.
3
votes
1answer
1k views

Is it Safe to Share the Wallet Keystore File Without Password?

There is an ICO that asks for ethereum keystore file, which is unusual for me as far as ICOs go. Even though it does not looks like it contains private key and password it still feels unsettling. Is ...
3
votes
2answers
361 views

Besides TheDAO - what are some examples of where Ether has been hacked, stolen or lost?

Besides TheDAO - what are some examples of where Ether has been hacked, stolen or lost ?
3
votes
3answers
2k views

How to recover public from tx signature(r,s) and verify signature?

My first question is how to verify signature using only r,s and elliptic curve paramete, and an address (which is hashed of public key, so cannot retrieve public key from the address)? Next question ...
3
votes
1answer
248 views

How secured are private data stored on blockchain?

I'm quite new in Ethereum world and I'm still little bit confused about this: If I store any data on blockchain, is it readable from anyone? Let's say I have this is Solidity: ... string private ...
3
votes
3answers
3k views

How to generate multiple eth-addresses from one private key? [duplicate]

Is it possible to generate different multiple eth-addresses from one private key? The goal is to implement a JavaScript service that will allow a user to buy a subscription using cryptocurrency. ...
3
votes
2answers
231 views

Why this ERC20 “stealing” transaction is valid?

I'm sending a token from account A to B. The account who issues transaction is C. Surprisingly, the transaction is valid and works fine. Why? This means that I, being the transaction issuer, can make ...
3
votes
1answer
478 views

Could msg.sender be changed by a hacker?

I was researching the msg object and I could not find out very much about how it is created. It seems to be that contracts depend on checking owner == msg.sender. That is dependent on msg.sender being ...
3
votes
3answers
1k views

Why is there a possibility to increase block gas limit?

As I know, in Bitcoin block size is limited to 1MB. This limits the number of transactions in a block and thus the transaction throughput and blockchain size growth rate. This in turn prevents ...
3
votes
1answer
650 views

Can I reuse a signed transaction generated offline by MyEtherWallet?

I generated a signed transaction using MyEtherWallet on an air-gapped computer, and used it to successfully send a transaction. Does anything prevent the signed transaction from being reused?
3
votes
2answers
6k views

How do I “Add Data” to a send transaction in Solidity

In myetherwallet, there is an +Advanced: Add Data Section where I can add data to the transaction. How can I add this same data in a transaction I make in Solidity?
3
votes
2answers
146 views

Are there any misbehaving miners?

Many of the discussions I read about security relate to how miners can manipulate this or that aspect of the way a transaction gets processed, such as whether or not it's included, what it's timestamp ...
3
votes
2answers
2k views

MetaMask: how can I access the web3 object locally and use my own node?

I am new to Ethereum and was looking for a way to run my dApp in Chrome instead of Mist. I encountered Metamask, which would in theory fit my needs perfectly. However, from a basic web point of view,...
3
votes
2answers
170 views

Is a race possible when checking the contract for liveness?

I wonder if a race is possible when performing a check of a return value of a call similar to eth.getCode(greeter.contractAddress) for being zero. That is, is it possible that the contract was alive ...
3
votes
2answers
520 views

How to maintain/administer nodes of a private network?

I might be wrong here, but I'm really trying to find out how to effectively control admission to a private Blockchain instance. Sure, I can put the IP + PubKey into the static-nodes.js or trusted-...
3
votes
2answers
218 views

Confidential value transfers

Is there currently any way to do confidential transactions with Ethereum for a custom token? If not, is there any work/research being done on how this might be possible?
3
votes
1answer
925 views

Why do we pay fees in Ethereum?

Why do we have to pay fees for transactions since miners have a reward for blocks they mine (5 per block)?
3
votes
2answers
1k views

Getting ParserError: Expected ',' but got 'payable' and also one important security issue with contract

I have write a small smart contract for lottery system. however there is problem. please see below full code. pragma solidity >=0.4.22 <0.6.0; contract Lottery{ address[] public players; //...
3
votes
1answer
403 views

How does PassHasBeenSet honeypot contract work?

I've been trying to pick this honeypot contract apart, but I haven't figured out exactly how it works. overview The premise is pretty simple, the contract is set up to look like a "new year's gift" ...
3
votes
1answer
394 views

What attacks have been performed against the Ethereum network and contracts?

Every time I fire up a new Ethereum node, I run into that very slow patch of syncing from 2016Q3 due to a DoS attack on the network. What other attacks have been performed against the Ethereum network ...
3
votes
1answer
242 views

Help me to understand the moral implications of the Ethereum blockchain, dapps, and data

Let me preface this with: I'm an Ethereum noob, and the technology is difficult to grasp. My question has a hypothetical scenario along with a few questions. I am having a hard time grasping how ...
3
votes
1answer
427 views

Connecting to my raspberry pi - how safe is that?

My setup is simple, I have a laptop and a raspberry pi on the same network. I installed parity on my raspberry pi and successfully connected to it, e.g., with geth attach http://192.168.1.:8545. All ...
3
votes
1answer
503 views

where is authentication happening in web3js?

When using web3 js to connect to ethereum private network, I just configured the http provider of the web3 instance to connect to the node. how is just info about RPC endpoint sufficient to be able ...
3
votes
1answer
470 views

Ethereum Ddos attack

I have a background in security, so i try to understand what is hapeneing to Ethereum project. Recently, i heard that Ethereum will make a fork to stop the Ddos attack. here i want to know how the ...

1 2 3
4
5
12