Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
4
votes
2answers
412 views

Reproducing stack depth attack

Victim contract allows one time withdraw only. I want to attack it using stack depth attack to withdraw everything it has. I've tried different things, but can't get the desired result. Here's where I'...
4
votes
1answer
376 views

What are the best practices when setting up / interacting with a hot wallet on an application server?

Let's say I have a small application running on a server that interacts with the Ethereum blockchain to occasionally send ETH to random addresses at random times. This application also has other ...
4
votes
2answers
2k views

How do I delete the geth console history?

how do I delete the geth console history ? I'm concerned with this, especially in light of this recent Mist hack : On the console you can also unlock accounts (one at a time). personal....
4
votes
2answers
2k views

Smallest number of nodes for an Ethereum private blockchain

In a public instance, one would expect the more miners the merrier, as this improves the overall mining diversity and therefore we get better security. Private blockchains, as in the Eris case, tend ...
4
votes
1answer
1k views

How to create a “cold wallet” and is it really necessary? [duplicate]

What's up everyone. I have a decent amount of Ether and I want to protect it as much as possible. I read that basically the only way someone could hack an ETH account would be with a keylogger program....
4
votes
2answers
2k views

Unlocking accounts for a back office app

I'm writing a "back office" app and need a way to unlock an account in an automated fashion. Yes, I know security of nodejs is questionable, but there are ways of solving this. blocking web3 from ...
4
votes
1answer
164 views

Underhanded Solidity: Exploiting multiple inheritance

In an article by Steve Marx (on Medium.com), the author argues against using inheritance in solidity not only because of harder readability of a Smart Contract, but also because it can be exploited in ...
4
votes
1answer
510 views

Is the content of a function and the data in a smart contract publicly readable?

When I create a smart contract with some functions in it, I know anyone can execute those functions. My question is; can anyone also read the source/logic of those functions? And I've got the same ...
4
votes
2answers
2k views

MetaMask: how can I access the web3 object locally and use my own node?

I am new to Ethereum and was looking for a way to run my dApp in Chrome instead of Mist. I encountered Metamask, which would in theory fit my needs perfectly. However, from a basic web point of view,...
4
votes
1answer
997 views

Transaction receipts, blocks and confirmations

In Bitcoin, there is a best practice to wait between three to six block confirmations before accepting an transaction. This is to avoid double spending. Are there similar rules of thumb in Ethereum? ...
4
votes
1answer
121 views

Did the spamming counter-attack on The DAO attack work to slow down the attacks?

This question was asked in the comment section of What does TheDAO counter-attack by spamming actually do? (suggested by Stephan Tual). Background links: The attacks used a recursive call ...
4
votes
1answer
202 views

Is having an open TCP port dangerous (Mac OSX)?

I was reading this post on reddit where a user got all her ether hacked because she had an open RCP port when deploying a contract. I just used network utility to run a scan and it turns out I have ...
4
votes
1answer
281 views

ERC20 transfer - caller expects return but none provided - what happens?

If someone implements the ERC20 transfer() function without the return value as follows: function transfer(address to, uint256 value) public { require( ... usual checks ... ); balances_[msg....
4
votes
1answer
119 views

Can an Ethereum key generated on a laptop be brute-forced by someone else because of low entropy?

I read this and this tweets. Though, I understand that this issue occur because some people use the same private key mentioned in a blog/forum. But, on the first tweet, people were talking about the ...
4
votes
1answer
238 views

Does the recent attack to “the DAO” means end of it? [duplicate]

However implementing the DAO and its smart contracts are incredibly exciting experiments, the recent attack to the DAO clearly suggested that the code is not safe and may or may not have more ...
4
votes
1answer
183 views

Trustlessness and Provability in DApp design

I am looking for suggestions or references on how to build proper trustlessness and provability into my DApps. These are DApp distinctives, but I find that thinking this through is like peeling back ...
4
votes
2answers
170 views

When a bonded node loses a bet who gets the ETH?

In Casper Proof-of-Stake, a validator needs to be a bonded node: it puts up a security deposit that can be lost if the validator misbehaves. When a bonded node misbehaves, who receives the lost ETH?
4
votes
1answer
419 views

Why doesn't Ethereum do double hashing like Bitcoin?

Why doesn't Ethereum do double hashing like Bitcoin? What are the facts or theories on the security of single Keccak-256 hashing like Ethereum, as compared to Bitcoin's double hashing with SHA2-256? ...
4
votes
1answer
287 views

What is the “pre-commit” scheme to defeat frontrunning attack?

I am writing to inquire feasible strategies to defeat Transaction Ordering Dependence (TOD) bugs. I learned from the best practice guideline such that we can use a so-called "pre-committed" scheme ...
4
votes
1answer
172 views

Malicious smart contract and stolen tokens from other contracts?

I'm wondering if by interacting with a contract, it could affect my ETH or tokens on other contracts. I'm asking because I'm seeing many EOS airdrops on ethereum that require us to send a 0 ETH ...
4
votes
1answer
285 views

Does a greater number of hashing rounds in aes-128-ctr scrypt key generation mean stronger encryption?

Consider the following Ethereum account I created at MyEtherWallet: { version: 3, id: '4447b704-e28c-4e93-8b1d-32f519b46692', address: '115312fc0ab77a0fb15a66baf51f58baefcee1dd', Crypto: { ...
4
votes
1answer
368 views

What to do with smart contracts to avoid replay attacks?

I am trying to write a smart contract for Crowdsale. What extra measures should one keep in mind during smart contract development to avoid replay attacks (after the hard fork of block 1,920,000)?
4
votes
1answer
333 views

Why exposing the personal API is unsafe?

From what I am reading in various places such as here ,here or here, it is not safe to expose the personal api to the front-end Dapp via RPC. Hence asking the users to run geth --rpc --rpcapi "eth,...
4
votes
2answers
938 views

How is the keccak256(a, b) function implemented?

I need to understand how keccak256(a, b) is implemented and how it differs from keccak256(a || b). Is the content padded? I need this because I do not want to allow for vulnerabilities where a user ...
4
votes
1answer
122 views

How to prevent an attack on a contract creation service

Say there is a smart contract that involves a buyer and seller. Anyone can instantiate this contract but eventually two parties, the buyer and seller, will register with the contract. A seller would ...
4
votes
3answers
657 views

ClamAV finds eicar in chaindata ldb and quarantines file

What would happen if one of the .ldb files from the mist chaindata was deleted, i.e. /Users/yourname/Library/Ethereum/chaindata/060540.ldb was removed. One of the ClamAV engines found a test virus ...
4
votes
0answers
117 views

Parity create testing transactions and blocks

For test purposes, I would like to make test blocks including test transactions against main net. For example I would like to make a transaction that sends one ether from 0x1234567... to 0x99999999......
4
votes
0answers
127 views

How is Casper better than POW against possible government censorship? [closed]

As of now my understanding is that with POW an attack by one or multiple goverments could be orchestrated just by raiding mining farms (which can be easily identified given the electricity bill) and ...
3
votes
7answers
3k views

Are there any tools that provide security reviews of Solidity code?

Do we have any standardized security scanning tool to go for security code review for solidity language? If not, what all opensource tools are there on which we can relay? Need response urgently.
3
votes
1answer
1k views

Is it Safe to Share the Wallet Keystore File Without Password?

There is an ICO that asks for ethereum keystore file, which is unusual for me as far as ICOs go. Even though it does not looks like it contains private key and password it still feels unsettling. Is ...
3
votes
2answers
364 views

Besides TheDAO - what are some examples of where Ether has been hacked, stolen or lost?

Besides TheDAO - what are some examples of where Ether has been hacked, stolen or lost ?
3
votes
3answers
2k views

How to recover public from tx signature(r,s) and verify signature?

My first question is how to verify signature using only r,s and elliptic curve paramete, and an address (which is hashed of public key, so cannot retrieve public key from the address)? Next question ...
3
votes
1answer
495 views

What's involved in making a private chain become a sidechain of Ethereum?

"A private Ethereum-based network that had a linkage allowing ether to be securely moved from the public Ethereum main chain onto it and back would be considered to be a sidechain of the public ...
3
votes
1answer
259 views

How secured are private data stored on blockchain?

I'm quite new in Ethereum world and I'm still little bit confused about this: If I store any data on blockchain, is it readable from anyone? Let's say I have this is Solidity: ... string private ...
3
votes
3answers
4k views

How to generate multiple eth-addresses from one private key? [duplicate]

Is it possible to generate different multiple eth-addresses from one private key? The goal is to implement a JavaScript service that will allow a user to buy a subscription using cryptocurrency. ...
3
votes
2answers
235 views

Why this ERC20 “stealing” transaction is valid?

I'm sending a token from account A to B. The account who issues transaction is C. Surprisingly, the transaction is valid and works fine. Why? This means that I, being the transaction issuer, can make ...
3
votes
1answer
494 views

Could msg.sender be changed by a hacker?

I was researching the msg object and I could not find out very much about how it is created. It seems to be that contracts depend on checking owner == msg.sender. That is dependent on msg.sender being ...
3
votes
3answers
1k views

Why is there a possibility to increase block gas limit?

As I know, in Bitcoin block size is limited to 1MB. This limits the number of transactions in a block and thus the transaction throughput and blockchain size growth rate. This in turn prevents ...
3
votes
1answer
652 views

Can I reuse a signed transaction generated offline by MyEtherWallet?

I generated a signed transaction using MyEtherWallet on an air-gapped computer, and used it to successfully send a transaction. Does anything prevent the signed transaction from being reused?
3
votes
2answers
6k views

How do I “Add Data” to a send transaction in Solidity

In myetherwallet, there is an +Advanced: Add Data Section where I can add data to the transaction. How can I add this same data in a transaction I make in Solidity?
3
votes
2answers
152 views

Are there any misbehaving miners?

Many of the discussions I read about security relate to how miners can manipulate this or that aspect of the way a transaction gets processed, such as whether or not it's included, what it's timestamp ...
3
votes
2answers
172 views

Is a race possible when checking the contract for liveness?

I wonder if a race is possible when performing a check of a return value of a call similar to eth.getCode(greeter.contractAddress) for being zero. That is, is it possible that the contract was alive ...
3
votes
2answers
532 views

How to maintain/administer nodes of a private network?

I might be wrong here, but I'm really trying to find out how to effectively control admission to a private Blockchain instance. Sure, I can put the IP + PubKey into the static-nodes.js or trusted-...
3
votes
2answers
218 views

Confidential value transfers

Is there currently any way to do confidential transactions with Ethereum for a custom token? If not, is there any work/research being done on how this might be possible?
3
votes
1answer
928 views

Why do we pay fees in Ethereum?

Why do we have to pay fees for transactions since miners have a reward for blocks they mine (5 per block)?
3
votes
1answer
115 views

Explain “griefing” attack on Aave flash loan

Aave doc about flash loan warns to never store funds inside a receiver contract as it can be exposed to "griefing" attack. So my questions are Can you give an example of this attack? How ...
3
votes
2answers
1k views

Getting ParserError: Expected ',' but got 'payable' and also one important security issue with contract

I have write a small smart contract for lottery system. however there is problem. please see below full code. pragma solidity >=0.4.22 <0.6.0; contract Lottery{ address[] public players; //...
3
votes
1answer
414 views

How does PassHasBeenSet honeypot contract work?

I've been trying to pick this honeypot contract apart, but I haven't figured out exactly how it works. overview The premise is pretty simple, the contract is set up to look like a "new year's gift" ...
3
votes
1answer
402 views

What attacks have been performed against the Ethereum network and contracts?

Every time I fire up a new Ethereum node, I run into that very slow patch of syncing from 2016Q3 due to a DoS attack on the network. What other attacks have been performed against the Ethereum network ...
3
votes
1answer
257 views

Help me to understand the moral implications of the Ethereum blockchain, dapps, and data

Let me preface this with: I'm an Ethereum noob, and the technology is difficult to grasp. My question has a hypothetical scenario along with a few questions. I am having a hard time grasping how ...

1 2 3
4
5
12