Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
3
votes
1answer
121 views

Potential attack vectors on an Ethereum account

Besides someone stealing your private key, what are other potential attack vectors on an Ethereum account?
3
votes
1answer
119 views

Risk of using BlockHash, other miners preventing attack. [duplicate]

When I read about the risk of using the blockhash as a random number it was explained to me the issue was that a miner can trow away the block if the block-hash is not in his advantage, and keeps ...
3
votes
1answer
416 views

How to bypass account unlock prompt in geth console private testnet

How to bypass account unlock in private testnet, i want to transfer randomly between address. Is this possible, if yes how? I am looking forward to bypass the prompt in console so that i can ...
3
votes
1answer
261 views

Vulnerability to Meltdown and Spectre?

Being a distributed computing platform, is Ethereum vulnerable to Meltdown and Spectre attacks?
3
votes
1answer
669 views

Is it possible to write the ACL smart-contract?

I wonder, is it possible to create Access Control List and change user rights by smart-contract in private blockchain? Can I set up the security policy by smart-contract?
3
votes
2answers
733 views

How to execute Transaction without unlocking Account from Web3 UI

I am working on App that will be deployed in private blockchain. For testing I used to unlock my Account from Geth console to overcome 'could not unlock signer account'. However there is a risk of ...
3
votes
1answer
444 views

How was the recursive call vulnerability attack conducted via proposal #59 when there were no Yes votes?

From Which split proposal was used to mount the recursive call vulnerability attack on The DAO?, proposal #59 is very likely the vector uses by the attacker to hack 3,641,694.241898506 Ether ($59,578,...
3
votes
1answer
171 views

Upgradable Smart Contracts - Is there consensus between shareholders when upgrades occur?

It seems that upgradable smart contracts are the new wave of the future seemingly for the all the right reasons. How does this work for the "hello world" smart contract where two users make a bet on ...
3
votes
1answer
877 views

Is it possible to create an X.509 certificate from an Ethereum/Bitcoin private key?

We all love Ethereum/Bitcoin (i.e. EC secp256k1) private keys, because they let us sign transactions. However, browsers don't support those keys for authentication -- what they do (sort of) support is ...
3
votes
1answer
470 views

Is opening a connection with geth secure?

I'm newly trying to do some tutorials in dapp development and I ran into an issue with security. I was trying to sync with testnet through geth. For the most part, it went smoothly. However, I was ...
3
votes
1answer
206 views

Proper way to unlockAccount

I'm running a private blockchain instance for personal development and I'm trying to understand what is the proper way to use personal.unlockAccount() to prevent a security risk. I understand the ...
3
votes
1answer
69 views

Make function invisible for general user

I have a pretty big contract with a few functions, some are designed for administrative goals. Here's a simplified example: contract big_contract { function user_function_1 (uint32 arg1, string ...
3
votes
1answer
67 views

How to count empty accounts?

Is there a way to count empty accounts using geth ? I just want to be able to track current DDOS cleanup process.
3
votes
1answer
62 views

High level discussion: anomaly monitor

I was reading about past attacks on Ethereum network and I pictured the following hypothetical scenario: there is a tool or automated, machine learning based anomalous monitor to check out constantly ...
3
votes
1answer
188 views

How can I avoid trusting any one node?

I read with interest the status of the light client protocol. However, I do not see addressed anywhere I can find how to implement a system where I don't have to trust any one single node such as a ...
3
votes
1answer
122 views

Potential security issues warning banners with Ethereum

I'm testing ethereum and the foundation websites states that Frontier is an early access to the Ethereum network. Bugs and security issues might be present. Before downloading you have to agree ...
3
votes
0answers
71 views

Storing Private Keys in IoT Devices

In a network of IoT devices like internet-connected Raspberry Pis which sends transactions to the Ethereum blockchain, the Pis need to be able to access their own Ethereum private keys in order to ...
3
votes
0answers
110 views

Parity create testing transactions and blocks

For test purposes, I would like to make test blocks including test transactions against main net. For example I would like to make a transaction that sends one ether from 0x1234567... to 0x99999999......
3
votes
1answer
768 views

DApp sign transactions on mobile and transfer to server - Web security

I'm currently developing an app for iOS and Android using React Native where users will have a wallet, made using: https://www.npmjs.com/package/ethereumjs-wallet-react-native. They then are able to ...
3
votes
0answers
1k views

Is this approach to an ethereum lottery sound and/or novel?

I'm looking at making gambling apps is ethereum. Currently made a contract that can flip a coin. After looking at this question: How can I securely generate a random number in my smart contract? and ...
3
votes
1answer
104 views

How does one securily store a user password in a browser? [closed]

After playing around with eth-lighwallet library I have a security related question. How does one securily store a user password in a browser? Imagine a situation where a user provides a password ...
3
votes
0answers
87 views

What is an empty account if the state root is not empty?

"State-bloat" attacks led to an empty account being defined as an account that has zero balance, nonce and code. There was a disagreement on EIP 161: I disagree. An account should be considered ...
3
votes
0answers
203 views

What's reverted and not reverted during an Out of Gas exception?

A seemingly crucial question on EIP 158 was unanswered: Unless the empty accounts are deleted even in the case of an EVM exception, if that is the case would that not break the guarantee that ...
3
votes
0answers
75 views

Is the 17 June 2016 operation legaly illigitimate? [closed]

It has been stated that since the creator of the DAO have called the contracts code as the only legal statement, all things that the code allows are legitimate. As a counterargument it was said that ...
2
votes
1answer
876 views

Solidity Security

I'm new in security of ICO and smart contracts. Trying to find bugs in verified contracts. I believe I found some problems in 0x42dB5Bfe8828f12F164586AF8A992B3a7B038164 but I dont know how to ...
2
votes
2answers
218 views

How can we address the security issues related to the executing of malicious codes?

Assume a malicious code exists in a contract (either written intentionally or not). Is there any mechanism to prevent such codes from being executed? Is it even possible to do the monitoring?
2
votes
1answer
561 views

How do contracts interact, and how is the network secured? [closed]

I don't understand what it means when people saying things such as "(Ethereum) applications can interact with each other on the blockchain, so a library of useful functionality will gradually build up"...
2
votes
2answers
1k views

Issue with New version of Metamask: Remix cannot detect the Metamask address

I have just installed Metamask version: 6.3.1 Now in Remix, the address of my account in metamask is not detected. The account box in remix remains always blank now (see picture below). Note that I ...
2
votes
2answers
566 views

Smart contracts and the inherent lack of security in trusting compiled byte code

Smart contracts on the blockchain are compiled. Is there any system in place to verify all the public dapp contracts do what they propose to be doing? i.e. this could be done by compiling open-source ...
2
votes
6answers
3k views

Are there any tools that provide security reviews of Solidity code?

Do we have any standardized security scanning tool to go for security code review for solidity language? If not, what all opensource tools are there on which we can relay? Need response urgently.
2
votes
2answers
288 views

Is it possible to access Ethereum API via the browser?

How do you access the api's of ethereum via the browser? Say I wanted to make a one page app that updates every 1 minute with the block number. And where can I get a list of all the API variables?
2
votes
1answer
485 views

What's involved in making a private chain become a sidechain of Ethereum?

"A private Ethereum-based network that had a linkage allowing ether to be securely moved from the public Ethereum main chain onto it and back would be considered to be a sidechain of the public ...
2
votes
3answers
350 views

Doesn't having a centralised front end pose a huge security risk to an Ethereum app?

My understanding is that the typical architecture for an Ethereum app is to have a smart contract acting as a backend to a centralized, stateless front end which runs on a single server. Doesn't this ...
2
votes
1answer
802 views

How does MetaMask save our mnemonic phrase? Is it safe enough?

How does MetaMask save our mnemonic phrase? Is it saved in browser local storage? Does it encrypt our mnemonic phrase?
2
votes
1answer
921 views

Is it secure to run public ethereum node? [duplicate]

I'm creating my first Ethereum contract with truffle. I want the web application to be usable without MetaMask so I was wondering if it is a good idea to run my own private node and to connect from ...
2
votes
1answer
90 views

Security of contract methods password protection. Is it a safe practice?

I want my server to modify the state of the contract. The server has the contract's secret key and a way of broadcasting signed transactions to the network using web3 ethereum provider hosted by ...
2
votes
3answers
220 views

How are end-users meant to build trust towards smart contracts (and their originators)?

One of the benefits commonly associated with Ethereum is that it allows end-users to interact directly with smart contracts and thereby removing the need for trusted-third-parties. In cases where: ...
2
votes
1answer
71 views

function input conditional check

I have a function which is accepting a string argument as input parameter. This string is an IPFS hash and I would like to check that the input is actually just that and not a malicious link or the ...
2
votes
2answers
829 views

What is an example of Use a pattern where the recipient withdraws the money?

In the Solidity docs it says: There are some dangers in using send: The transfer fails if the call stack depth is at 1024 (this can always be forced by the caller) and it also fails if the ...
2
votes
1answer
328 views

How will the number of confirmations for security change with Casper?

How will this answer change when Casper is deployed?
2
votes
1answer
33 views

Is the May 2017 contract creation attack still possible?

In May 2017, an "attacker" created a contract that attempts to create many other contracts(using many JUMPDEST operations in the creation bytecode) until it runs out of gas. I see the gas ...
2
votes
2answers
65 views

Revert()/throw/invalid are so powerful they can even put back an already self-destructed contract, but is there a way to surpass such limitation?

I know this sounds confusing so let me explain: In this case below a transaction will succeed and a contract will be first destroyed and then re-initialized on the same address (yes, I didn't think ...
2
votes
1answer
48 views

How to access a smart contract function protected by access rights using Web3?

I have a smart contract address for security tokens, and certain functions of it are protected by access rights, for which I have an address to access those functions, however I am not able to figure ...
2
votes
2answers
971 views

Getting ParserError: Expected ',' but got 'payable' and also one important security issue with contract

I have write a small smart contract for lottery system. however there is problem. please see below full code. pragma solidity >=0.4.22 <0.6.0; contract Lottery{ address[] public players; //...
2
votes
1answer
400 views

Keeping private key for signing transactions on a local server

Need an idea for not storing private key to sign transactions (on public server/database file system). The private key is needed to sign the transactions for transfer function ERC20 standard. To ...
2
votes
1answer
288 views

How to implement user deposits for tokens for an exchange

If we generate new deposit addresses for every user we face following problems: - we need to transfer tokens from individual wallets to our exchange wallets - we need to fund the wallets with ether to ...
2
votes
3answers
434 views

In ethereum, what happen if someone controls a large majority of mining power?

If someone manages more than 50% of the mining power, this situation necessarily compromises the integrity of the past blocks and newly generating blocks?
2
votes
2answers
82 views

Making a contract unreproducible

I want to make a contract, from a factory contract, that can't be replicated by contracts deployed by other addresses. The factory contract will be called by different addresses so signing a piece of ...
2
votes
1answer
664 views

Could private values be read by other contracts?

While studying blockchain interoperability (like BTC relay or a Dogecoin relay), it came to my mind that if the Ethereum blockchain can read another blockchain, we could use the same process to make ...
2
votes
1answer
266 views

testrpc security implications of opening mist with a custom RPC Port?

I am trying to use the testrpc, and one of the solutions I found was to run testrpc in one terminal window, and then run Mist --rpc localhost:8545 in another. When doing this, the following warning ...

1
3 4
5
6 7
11