Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
4
votes
1answer
900 views

Transaction receipts, blocks and confirmations

In Bitcoin, there is a best practice to wait between three to six block confirmations before accepting an transaction. This is to avoid double spending. Are there similar rules of thumb in Ethereum? ...
4
votes
1answer
115 views

Did the spamming counter-attack on The DAO attack work to slow down the attacks?

This question was asked in the comment section of What does TheDAO counter-attack by spamming actually do? (suggested by Stephan Tual). Background links: The attacks used a recursive call ...
4
votes
1answer
176 views

Is having an open TCP port dangerous (Mac OSX)?

I was reading this post on reddit where a user got all her ether hacked because she had an open RCP port when deploying a contract. I just used network utility to run a scan and it turns out I have ...
4
votes
1answer
234 views

ERC20 transfer - caller expects return but none provided - what happens?

If someone implements the ERC20 transfer() function without the return value as follows: function transfer(address to, uint256 value) public { require( ... usual checks ... ); balances_[msg....
4
votes
1answer
112 views

Can an Ethereum key generated on a laptop be brute-forced by someone else because of low entropy?

I read this and this tweets. Though, I understand that this issue occur because some people use the same private key mentioned in a blog/forum. But, on the first tweet, people were talking about the ...
4
votes
1answer
233 views

Does the recent attack to “the DAO” means end of it? [duplicate]

However implementing the DAO and its smart contracts are incredibly exciting experiments, the recent attack to the DAO clearly suggested that the code is not safe and may or may not have more ...
4
votes
1answer
176 views

Trustlessness and Provability in DApp design

I am looking for suggestions or references on how to build proper trustlessness and provability into my DApps. These are DApp distinctives, but I find that thinking this through is like peeling back ...
4
votes
2answers
163 views

When a bonded node loses a bet who gets the ETH?

In Casper Proof-of-Stake, a validator needs to be a bonded node: it puts up a security deposit that can be lost if the validator misbehaves. When a bonded node misbehaves, who receives the lost ETH?
4
votes
1answer
385 views

Why doesn't Ethereum do double hashing like Bitcoin?

Why doesn't Ethereum do double hashing like Bitcoin? What are the facts or theories on the security of single Keccak-256 hashing like Ethereum, as compared to Bitcoin's double hashing with SHA2-256? ...
4
votes
1answer
271 views

Security of PoS if/when Assets (Tracked or Native) to Ethereum exceed the total Value of Ether

Given that Ethereum naturally allows for the creation of arbitrary tokens that can either have value themselves or track a real-world asset, can Ethereum be secured by PoW/PoS when the total assets on ...
4
votes
1answer
271 views

Can I import my wallet into more than one computer?

Is it safe & secure to import my wallet into multiple Ethereum clients?
4
votes
1answer
49 views

Why is the subcall gas limit set to 63/64th of the remaining gas?

From the solidity docs: Calls are limited to a depth of 1024, which means that for more complex operations, loops should be preferred over recursive calls. Furthermore, only 63/64th of the gas can ...
4
votes
1answer
127 views

Malicious smart contract and stolen tokens from other contracts?

I'm wondering if by interacting with a contract, it could affect my ETH or tokens on other contracts. I'm asking because I'm seeing many EOS airdrops on ethereum that require us to send a 0 ETH ...
4
votes
1answer
273 views

Does a greater number of hashing rounds in aes-128-ctr scrypt key generation mean stronger encryption?

Consider the following Ethereum account I created at MyEtherWallet: { version: 3, id: '4447b704-e28c-4e93-8b1d-32f519b46692', address: '115312fc0ab77a0fb15a66baf51f58baefcee1dd', Crypto: { ...
4
votes
1answer
348 views

What to do with smart contracts to avoid replay attacks?

I am trying to write a smart contract for Crowdsale. What extra measures should one keep in mind during smart contract development to avoid replay attacks (after the hard fork of block 1,920,000)?
4
votes
1answer
286 views

Why exposing the personal API is unsafe?

From what I am reading in various places such as here ,here or here, it is not safe to expose the personal api to the front-end Dapp via RPC. Hence asking the users to run geth --rpc --rpcapi "eth,...
4
votes
2answers
760 views

How is the keccak256(a, b) function implemented?

I need to understand how keccak256(a, b) is implemented and how it differs from keccak256(a || b). Is the content padded? I need this because I do not want to allow for vulnerabilities where a user ...
4
votes
1answer
914 views

Dealing with the short address attack

I'm writing a contract for an ERC20 token, based on Zepellin contracts. I noticed that their code doesn't handle the short address attack. Does it mean I shouldn't care about it?
4
votes
1answer
89 views

How to prevent an attack on a contract creation service

Say there is a smart contract that involves a buyer and seller. Anyone can instantiate this contract but eventually two parties, the buyer and seller, will register with the contract. A seller would ...
4
votes
3answers
628 views

ClamAV finds eicar in chaindata ldb and quarantines file

What would happen if one of the .ldb files from the mist chaindata was deleted, i.e. /Users/yourname/Library/Ethereum/chaindata/060540.ldb was removed. One of the ClamAV engines found a test virus ...
4
votes
0answers
126 views

How is Casper better than POW against possible government censorship? [closed]

As of now my understanding is that with POW an attack by one or multiple goverments could be orchestrated just by raiding mining farms (which can be easily identified given the electricity bill) and ...
3
votes
1answer
391 views

What's the vulnerability in my contract?

I've got a contract deployed at 0xe559835D7979dAe994331DEfaEc2FBA057E56C27 on the mainnet. Every time I go to call the payable function, which is solve, a bot beats me to it. My transaction gets ...
3
votes
1answer
1k views

Is it Safe to Share the Wallet Keystore File Without Password?

There is an ICO that asks for ethereum keystore file, which is unusual for me as far as ICOs go. Even though it does not looks like it contains private key and password it still feels unsettling. Is ...
3
votes
2answers
354 views

Besides TheDAO - what are some examples of where Ether has been hacked, stolen or lost?

Besides TheDAO - what are some examples of where Ether has been hacked, stolen or lost ?
3
votes
3answers
2k views

How to recover public from tx signature(r,s) and verify signature?

My first question is how to verify signature using only r,s and elliptic curve paramete, and an address (which is hashed of public key, so cannot retrieve public key from the address)? Next question ...
3
votes
1answer
224 views

How secured are private data stored on blockchain?

I'm quite new in Ethereum world and I'm still little bit confused about this: If I store any data on blockchain, is it readable from anyone? Let's say I have this is Solidity: ... string private ...
3
votes
2answers
216 views

Why this ERC20 “stealing” transaction is valid?

I'm sending a token from account A to B. The account who issues transaction is C. Surprisingly, the transaction is valid and works fine. Why? This means that I, being the transaction issuer, can make ...
3
votes
1answer
429 views

Could msg.sender be changed by a hacker?

I was researching the msg object and I could not find out very much about how it is created. It seems to be that contracts depend on checking owner == msg.sender. That is dependent on msg.sender being ...
3
votes
3answers
1k views

Why is there a possibility to increase block gas limit?

As I know, in Bitcoin block size is limited to 1MB. This limits the number of transactions in a block and thus the transaction throughput and blockchain size growth rate. This in turn prevents ...
3
votes
1answer
644 views

Can I reuse a signed transaction generated offline by MyEtherWallet?

I generated a signed transaction using MyEtherWallet on an air-gapped computer, and used it to successfully send a transaction. Does anything prevent the signed transaction from being reused?
3
votes
2answers
5k views

How do I “Add Data” to a send transaction in Solidity

In myetherwallet, there is an +Advanced: Add Data Section where I can add data to the transaction. How can I add this same data in a transaction I make in Solidity?
3
votes
2answers
141 views

Are there any misbehaving miners?

Many of the discussions I read about security relate to how miners can manipulate this or that aspect of the way a transaction gets processed, such as whether or not it's included, what it's timestamp ...
3
votes
2answers
2k views

MetaMask: how can I access the web3 object locally and use my own node?

I am new to Ethereum and was looking for a way to run my dApp in Chrome instead of Mist. I encountered Metamask, which would in theory fit my needs perfectly. However, from a basic web point of view,...
3
votes
2answers
164 views

Is a race possible when checking the contract for liveness?

I wonder if a race is possible when performing a check of a return value of a call similar to eth.getCode(greeter.contractAddress) for being zero. That is, is it possible that the contract was alive ...
3
votes
2answers
501 views

How to maintain/administer nodes of a private network?

I might be wrong here, but I'm really trying to find out how to effectively control admission to a private Blockchain instance. Sure, I can put the IP + PubKey into the static-nodes.js or trusted-...
3
votes
2answers
213 views

Confidential value transfers

Is there currently any way to do confidential transactions with Ethereum for a custom token? If not, is there any work/research being done on how this might be possible?
3
votes
1answer
918 views

Why do we pay fees in Ethereum?

Why do we have to pay fees for transactions since miners have a reward for blocks they mine (5 per block)?
3
votes
1answer
387 views

What attacks have been performed against the Ethereum network and contracts?

Every time I fire up a new Ethereum node, I run into that very slow patch of syncing from 2016Q3 due to a DoS attack on the network. What other attacks have been performed against the Ethereum network ...
3
votes
1answer
318 views

What are the best practices when setting up / interacting with a hot wallet on an application server?

Let's say I have a small application running on a server that interacts with the Ethereum blockchain to occasionally send ETH to random addresses at random times. This application also has other ...
3
votes
1answer
233 views

Help me to understand the moral implications of the Ethereum blockchain, dapps, and data

Let me preface this with: I'm an Ethereum noob, and the technology is difficult to grasp. My question has a hypothetical scenario along with a few questions. I am having a hard time grasping how ...
3
votes
1answer
417 views

Connecting to my raspberry pi - how safe is that?

My setup is simple, I have a laptop and a raspberry pi on the same network. I installed parity on my raspberry pi and successfully connected to it, e.g., with geth attach http://192.168.1.:8545. All ...
3
votes
1answer
483 views

where is authentication happening in web3js?

When using web3 js to connect to ethereum private network, I just configured the http provider of the web3 instance to connect to the node. how is just info about RPC endpoint sufficient to be able ...
3
votes
1answer
462 views

Ethereum Ddos attack

I have a background in security, so i try to understand what is hapeneing to Ethereum project. Recently, i heard that Ethereum will make a fork to stop the Ddos attack. here i want to know how the ...
3
votes
2answers
122 views

Is there any risk in receiving ETH in a pre-hard fork account having equal amounts of ETH and ETC?

As written in the title, I am wondering if doing this would be safe, or if there's anything else I should be aware about. I want to buy ETH via Kraken and send it to that account. I've been reading ...
3
votes
1answer
312 views

Which accounts are involved in mounting the recursive call vulnerability attacks on The DAO?

The first transaction 0x0ec3f2488a93839524add10ea229e773f6bc891b4eb4794c3337d4495263790b was initiated from account 0x969837498944ae1dc0dcac2d0c65634c88729b2d to the contract at ...
3
votes
1answer
285 views

Which split proposal was used to mount the recursive call vulnerability attack on The DAO?

I'm assuming that a split proposal was used to mount the recursive call vulnerability attack on The DAO. Which of the splits below was used to mount this attack? Here are the current list of splits: ...
3
votes
1answer
116 views

Potential attack vectors on an Ethereum account

Besides someone stealing your private key, what are other potential attack vectors on an Ethereum account?
3
votes
1answer
112 views

Risk of using BlockHash, other miners preventing attack. [duplicate]

When I read about the risk of using the blockhash as a random number it was explained to me the issue was that a miner can trow away the block if the block-hash is not in his advantage, and keeps ...
3
votes
1answer
411 views

How to bypass account unlock prompt in geth console private testnet

How to bypass account unlock in private testnet, i want to transfer randomly between address. Is this possible, if yes how? I am looking forward to bypass the prompt in console so that i can ...
3
votes
1answer
112 views

What is the “pre-commit” scheme to defeat TOD attack?

I am writing to inquire feasible strategies to defeat Transaction Ordering Dependence (TOD) bugs. I learned from the best practice guideline such that we can use a so-called "pre-committed" scheme ...

1 2 3
4
5
11