Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
3
votes
1answer
474 views

Ethereum Ddos attack

I have a background in security, so i try to understand what is hapeneing to Ethereum project. Recently, i heard that Ethereum will make a fork to stop the Ddos attack. here i want to know how the ...
3
votes
2answers
128 views

Is there any risk in receiving ETH in a pre-hard fork account having equal amounts of ETH and ETC?

As written in the title, I am wondering if doing this would be safe, or if there's anything else I should be aware about. I want to buy ETH via Kraken and send it to that account. I've been reading ...
3
votes
1answer
349 views

Which accounts are involved in mounting the recursive call vulnerability attacks on The DAO?

The first transaction 0x0ec3f2488a93839524add10ea229e773f6bc891b4eb4794c3337d4495263790b was initiated from account 0x969837498944ae1dc0dcac2d0c65634c88729b2d to the contract at ...
3
votes
1answer
299 views

Which split proposal was used to mount the recursive call vulnerability attack on The DAO?

I'm assuming that a split proposal was used to mount the recursive call vulnerability attack on The DAO. Which of the splits below was used to mount this attack? Here are the current list of splits: ...
3
votes
1answer
123 views

Potential attack vectors on an Ethereum account

Besides someone stealing your private key, what are other potential attack vectors on an Ethereum account?
3
votes
1answer
127 views

Risk of using BlockHash, other miners preventing attack. [duplicate]

When I read about the risk of using the blockhash as a random number it was explained to me the issue was that a miner can trow away the block if the block-hash is not in his advantage, and keeps ...
3
votes
1answer
422 views

How to bypass account unlock prompt in geth console private testnet

How to bypass account unlock in private testnet, i want to transfer randomly between address. Is this possible, if yes how? I am looking forward to bypass the prompt in console so that i can ...
3
votes
1answer
261 views

Vulnerability to Meltdown and Spectre?

Being a distributed computing platform, is Ethereum vulnerable to Meltdown and Spectre attacks?
3
votes
1answer
696 views

Is it possible to write the ACL smart-contract?

I wonder, is it possible to create Access Control List and change user rights by smart-contract in private blockchain? Can I set up the security policy by smart-contract?
3
votes
2answers
769 views

How to execute Transaction without unlocking Account from Web3 UI

I am working on App that will be deployed in private blockchain. For testing I used to unlock my Account from Geth console to overcome 'could not unlock signer account'. However there is a risk of ...
3
votes
1answer
449 views

How was the recursive call vulnerability attack conducted via proposal #59 when there were no Yes votes?

From Which split proposal was used to mount the recursive call vulnerability attack on The DAO?, proposal #59 is very likely the vector uses by the attacker to hack 3,641,694.241898506 Ether ($59,578,...
3
votes
1answer
174 views

Upgradable Smart Contracts - Is there consensus between shareholders when upgrades occur?

It seems that upgradable smart contracts are the new wave of the future seemingly for the all the right reasons. How does this work for the "hello world" smart contract where two users make a bet on ...
3
votes
1answer
1k views

Is it possible to create an X.509 certificate from an Ethereum/Bitcoin private key?

We all love Ethereum/Bitcoin (i.e. EC secp256k1) private keys, because they let us sign transactions. However, browsers don't support those keys for authentication -- what they do (sort of) support is ...
3
votes
1answer
511 views

Is opening a connection with geth secure?

I'm newly trying to do some tutorials in dapp development and I ran into an issue with security. I was trying to sync with testnet through geth. For the most part, it went smoothly. However, I was ...
3
votes
1answer
209 views

Proper way to unlockAccount

I'm running a private blockchain instance for personal development and I'm trying to understand what is the proper way to use personal.unlockAccount() to prevent a security risk. I understand the ...
3
votes
1answer
69 views

Make function invisible for general user

I have a pretty big contract with a few functions, some are designed for administrative goals. Here's a simplified example: contract big_contract { function user_function_1 (uint32 arg1, string ...
3
votes
1answer
73 views

How to count empty accounts?

Is there a way to count empty accounts using geth ? I just want to be able to track current DDOS cleanup process.
3
votes
1answer
62 views

High level discussion: anomaly monitor

I was reading about past attacks on Ethereum network and I pictured the following hypothetical scenario: there is a tool or automated, machine learning based anomalous monitor to check out constantly ...
3
votes
1answer
191 views

How can I avoid trusting any one node?

I read with interest the status of the light client protocol. However, I do not see addressed anywhere I can find how to implement a system where I don't have to trust any one single node such as a ...
3
votes
1answer
122 views

Potential security issues warning banners with Ethereum

I'm testing ethereum and the foundation websites states that Frontier is an early access to the Ethereum network. Bugs and security issues might be present. Before downloading you have to agree ...
3
votes
2answers
62 views
+100

What if a chain is compromised?

I have deployed a dApp on a sidechain (namely xDai) and am worried about its security. What happens if an EVM chain is compromised? Will it be rolled back after a few hours? or what? If the mainnet is ...
3
votes
1answer
48 views

What are the drawbacks of layer 2?

The scalability trilemma states that a blockchain can only have two out the following three properties: decentralization, scalability, and security. Layer 2 protocols aim to make Ethereum more ...
3
votes
0answers
74 views

Storing Private Keys in IoT Devices

In a network of IoT devices like internet-connected Raspberry Pis which sends transactions to the Ethereum blockchain, the Pis need to be able to access their own Ethereum private keys in order to ...
3
votes
0answers
118 views

Parity create testing transactions and blocks

For test purposes, I would like to make test blocks including test transactions against main net. For example I would like to make a transaction that sends one ether from 0x1234567... to 0x99999999......
3
votes
1answer
819 views

DApp sign transactions on mobile and transfer to server - Web security

I'm currently developing an app for iOS and Android using React Native where users will have a wallet, made using: https://www.npmjs.com/package/ethereumjs-wallet-react-native. They then are able to ...
3
votes
0answers
1k views

Is this approach to an ethereum lottery sound and/or novel?

I'm looking at making gambling apps is ethereum. Currently made a contract that can flip a coin. After looking at this question: How can I securely generate a random number in my smart contract? and ...
3
votes
1answer
105 views

How does one securily store a user password in a browser? [closed]

After playing around with eth-lighwallet library I have a security related question. How does one securily store a user password in a browser? Imagine a situation where a user provides a password ...
3
votes
0answers
90 views

What is an empty account if the state root is not empty?

"State-bloat" attacks led to an empty account being defined as an account that has zero balance, nonce and code. There was a disagreement on EIP 161: I disagree. An account should be considered ...
3
votes
0answers
232 views

What's reverted and not reverted during an Out of Gas exception?

A seemingly crucial question on EIP 158 was unanswered: Unless the empty accounts are deleted even in the case of an EVM exception, if that is the case would that not break the guarantee that ...
3
votes
0answers
75 views

Is the 17 June 2016 operation legaly illigitimate? [closed]

It has been stated that since the creator of the DAO have called the contracts code as the only legal statement, all things that the code allows are legitimate. As a counterargument it was said that ...
2
votes
1answer
922 views

Solidity Security

I'm new in security of ICO and smart contracts. Trying to find bugs in verified contracts. I believe I found some problems in 0x42dB5Bfe8828f12F164586AF8A992B3a7B038164 but I dont know how to ...
2
votes
2answers
220 views

How can we address the security issues related to the executing of malicious codes?

Assume a malicious code exists in a contract (either written intentionally or not). Is there any mechanism to prevent such codes from being executed? Is it even possible to do the monitoring?
2
votes
1answer
562 views

How do contracts interact, and how is the network secured? [closed]

I don't understand what it means when people saying things such as "(Ethereum) applications can interact with each other on the blockchain, so a library of useful functionality will gradually build up"...
2
votes
2answers
2k views

Issue with New version of Metamask: Remix cannot detect the Metamask address

I have just installed Metamask version: 6.3.1 Now in Remix, the address of my account in metamask is not detected. The account box in remix remains always blank now (see picture below). Note that I ...
2
votes
2answers
575 views

Smart contracts and the inherent lack of security in trusting compiled byte code

Smart contracts on the blockchain are compiled. Is there any system in place to verify all the public dapp contracts do what they propose to be doing? i.e. this could be done by compiling open-source ...
2
votes
1answer
1k views

Is it secure to run public ethereum node? [duplicate]

I'm creating my first Ethereum contract with truffle. I want the web application to be usable without MetaMask so I was wondering if it is a good idea to run my own private node and to connect from ...
2
votes
2answers
292 views

Is it possible to access Ethereum API via the browser?

How do you access the api's of ethereum via the browser? Say I wanted to make a one page app that updates every 1 minute with the block number. And where can I get a list of all the API variables?
2
votes
1answer
495 views

What's involved in making a private chain become a sidechain of Ethereum?

"A private Ethereum-based network that had a linkage allowing ether to be securely moved from the public Ethereum main chain onto it and back would be considered to be a sidechain of the public ...
2
votes
3answers
356 views

Doesn't having a centralised front end pose a huge security risk to an Ethereum app?

My understanding is that the typical architecture for an Ethereum app is to have a smart contract acting as a backend to a centralized, stateless front end which runs on a single server. Doesn't this ...
2
votes
1answer
847 views

How does MetaMask save our mnemonic phrase? Is it safe enough?

How does MetaMask save our mnemonic phrase? Is it saved in browser local storage? Does it encrypt our mnemonic phrase?
2
votes
1answer
91 views

Security of contract methods password protection. Is it a safe practice?

I want my server to modify the state of the contract. The server has the contract's secret key and a way of broadcasting signed transactions to the network using web3 ethereum provider hosted by ...
2
votes
3answers
242 views

How are end-users meant to build trust towards smart contracts (and their originators)?

One of the benefits commonly associated with Ethereum is that it allows end-users to interact directly with smart contracts and thereby removing the need for trusted-third-parties. In cases where: ...
2
votes
1answer
82 views

function input conditional check

I have a function which is accepting a string argument as input parameter. This string is an IPFS hash and I would like to check that the input is actually just that and not a malicious link or the ...
2
votes
2answers
841 views

What is an example of Use a pattern where the recipient withdraws the money?

In the Solidity docs it says: There are some dangers in using send: The transfer fails if the call stack depth is at 1024 (this can always be forced by the caller) and it also fails if the ...
2
votes
1answer
335 views

How will the number of confirmations for security change with Casper?

How will this answer change when Casper is deployed?
2
votes
1answer
36 views

Is the May 2017 contract creation attack still possible?

In May 2017, an "attacker" created a contract that attempts to create many other contracts(using many JUMPDEST operations in the creation bytecode) until it runs out of gas. I see the gas ...
2
votes
2answers
76 views

Revert()/throw/invalid are so powerful they can even put back an already self-destructed contract, but is there a way to surpass such limitation?

I know this sounds confusing so let me explain: In this case below a transaction will succeed and a contract will be first destroyed and then re-initialized on the same address (yes, I didn't think ...
2
votes
1answer
52 views

How to access a smart contract function protected by access rights using Web3?

I have a smart contract address for security tokens, and certain functions of it are protected by access rights, for which I have an address to access those functions, however I am not able to figure ...
2
votes
1answer
448 views

Keeping private key for signing transactions on a local server

Need an idea for not storing private key to sign transactions (on public server/database file system). The private key is needed to sign the transactions for transfer function ERC20 standard. To ...
2
votes
1answer
306 views

How to implement user deposits for tokens for an exchange

If we generate new deposit addresses for every user we face following problems: - we need to transfer tokens from individual wallets to our exchange wallets - we need to fund the wallets with ether to ...

1
3 4
5
6 7
12