Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
3
votes
1answer
257 views

Vulnerability to Meltdown and Spectre?

Being a distributed computing platform, is Ethereum vulnerable to Meltdown and Spectre attacks?
3
votes
1answer
651 views

Is it possible to write the ACL smart-contract?

I wonder, is it possible to create Access Control List and change user rights by smart-contract in private blockchain? Can I set up the security policy by smart-contract?
3
votes
2answers
700 views

How to execute Transaction without unlocking Account from Web3 UI

I am working on App that will be deployed in private blockchain. For testing I used to unlock my Account from Geth console to overcome 'could not unlock signer account'. However there is a risk of ...
3
votes
1answer
437 views

How was the recursive call vulnerability attack conducted via proposal #59 when there were no Yes votes?

From Which split proposal was used to mount the recursive call vulnerability attack on The DAO?, proposal #59 is very likely the vector uses by the attacker to hack 3,641,694.241898506 Ether ($59,578,...
3
votes
1answer
158 views

Upgradable Smart Contracts - Is there consensus between shareholders when upgrades occur?

It seems that upgradable smart contracts are the new wave of the future seemingly for the all the right reasons. How does this work for the "hello world" smart contract where two users make a bet on ...
3
votes
1answer
464 views

Is opening a connection with geth secure?

I'm newly trying to do some tutorials in dapp development and I ran into an issue with security. I was trying to sync with testnet through geth. For the most part, it went smoothly. However, I was ...
3
votes
1answer
199 views

Proper way to unlockAccount

I'm running a private blockchain instance for personal development and I'm trying to understand what is the proper way to use personal.unlockAccount() to prevent a security risk. I understand the ...
3
votes
1answer
65 views

Make function invisible for general user

I have a pretty big contract with a few functions, some are designed for administrative goals. Here's a simplified example: contract big_contract { function user_function_1 (uint32 arg1, string ...
3
votes
1answer
60 views

How to count empty accounts?

Is there a way to count empty accounts using geth ? I just want to be able to track current DDOS cleanup process.
3
votes
1answer
57 views

High level discussion: anomaly monitor

I was reading about past attacks on Ethereum network and I pictured the following hypothetical scenario: there is a tool or automated, machine learning based anomalous monitor to check out constantly ...
3
votes
1answer
182 views

How can I avoid trusting any one node?

I read with interest the status of the light client protocol. However, I do not see addressed anywhere I can find how to implement a system where I don't have to trust any one single node such as a ...
3
votes
1answer
119 views

Potential security issues warning banners with Ethereum

I'm testing ethereum and the foundation websites states that Frontier is an early access to the Ethereum network. Bugs and security issues might be present. Before downloading you have to agree ...
3
votes
0answers
65 views

Storing Private Keys in IoT Devices

In a network of IoT devices like internet-connected Raspberry Pis which sends transactions to the Ethereum blockchain, the Pis need to be able to access their own Ethereum private keys in order to ...
3
votes
0answers
106 views

Parity create testing transactions and blocks

For test purposes, I would like to make test blocks including test transactions against main net. For example I would like to make a transaction that sends one ether from 0x1234567... to 0x99999999......
3
votes
1answer
735 views

DApp sign transactions on mobile and transfer to server - Web security

I'm currently developing an app for iOS and Android using React Native where users will have a wallet, made using: https://www.npmjs.com/package/ethereumjs-wallet-react-native. They then are able to ...
3
votes
0answers
1k views

Is this approach to an ethereum lottery sound and/or novel?

I'm looking at making gambling apps is ethereum. Currently made a contract that can flip a coin. After looking at this question: How can I securely generate a random number in my smart contract? and ...
3
votes
1answer
100 views

How does one securily store a user password in a browser? [closed]

After playing around with eth-lighwallet library I have a security related question. How does one securily store a user password in a browser? Imagine a situation where a user provides a password ...
3
votes
0answers
187 views

What's reverted and not reverted during an Out of Gas exception?

A seemingly crucial question on EIP 158 was unanswered: Unless the empty accounts are deleted even in the case of an EVM exception, if that is the case would that not break the guarantee that ...
3
votes
0answers
73 views

Is the 17 June 2016 operation legaly illigitimate? [closed]

It has been stated that since the creator of the DAO have called the contracts code as the only legal statement, all things that the code allows are legitimate. As a counterargument it was said that ...
2
votes
1answer
868 views

Solidity Security

I'm new in security of ICO and smart contracts. Trying to find bugs in verified contracts. I believe I found some problems in 0x42dB5Bfe8828f12F164586AF8A992B3a7B038164 but I dont know how to ...
2
votes
2answers
215 views

How can we address the security issues related to the executing of malicious codes?

Assume a malicious code exists in a contract (either written intentionally or not). Is there any mechanism to prevent such codes from being executed? Is it even possible to do the monitoring?
2
votes
1answer
553 views

How do contracts interact, and how is the network secured? [closed]

I don't understand what it means when people saying things such as "(Ethereum) applications can interact with each other on the blockchain, so a library of useful functionality will gradually build up"...
2
votes
2answers
1k views

Issue with New version of Metamask: Remix cannot detect the Metamask address

I have just installed Metamask version: 6.3.1 Now in Remix, the address of my account in metamask is not detected. The account box in remix remains always blank now (see picture below). Note that I ...
2
votes
2answers
553 views

Smart contracts and the inherent lack of security in trusting compiled byte code

Smart contracts on the blockchain are compiled. Is there any system in place to verify all the public dapp contracts do what they propose to be doing? i.e. this could be done by compiling open-source ...
2
votes
6answers
3k views

Are there any tools that provide security reviews of Solidity code?

Do we have any standardized security scanning tool to go for security code review for solidity language? If not, what all opensource tools are there on which we can relay? Need response urgently.
2
votes
2answers
283 views

Is it possible to access Ethereum API via the browser?

How do you access the api's of ethereum via the browser? Say I wanted to make a one page app that updates every 1 minute with the block number. And where can I get a list of all the API variables?
2
votes
1answer
473 views

What's involved in making a private chain become a sidechain of Ethereum?

"A private Ethereum-based network that had a linkage allowing ether to be securely moved from the public Ethereum main chain onto it and back would be considered to be a sidechain of the public ...
2
votes
3answers
3k views

How to generate multiple eth-addresses from one private key? [duplicate]

Is it possible to generate different multiple eth-addresses from one private key? The goal is to implement a JavaScript service that will allow a user to buy a subscription using cryptocurrency. ...
2
votes
3answers
345 views

Doesn't having a centralised front end pose a huge security risk to an Ethereum app?

My understanding is that the typical architecture for an Ethereum app is to have a smart contract acting as a backend to a centralized, stateless front end which runs on a single server. Doesn't this ...
2
votes
1answer
784 views

How does MetaMask save our mnemonic phrase? Is it safe enough?

How does MetaMask save our mnemonic phrase? Is it saved in browser local storage? Does it encrypt our mnemonic phrase?
2
votes
1answer
893 views

Is it secure to run public ethereum node? [duplicate]

I'm creating my first Ethereum contract with truffle. I want the web application to be usable without MetaMask so I was wondering if it is a good idea to run my own private node and to connect from ...
2
votes
1answer
87 views

Security of contract methods password protection. Is it a safe practice?

I want my server to modify the state of the contract. The server has the contract's secret key and a way of broadcasting signed transactions to the network using web3 ethereum provider hosted by ...
2
votes
3answers
210 views

How are end-users meant to build trust towards smart contracts (and their originators)?

One of the benefits commonly associated with Ethereum is that it allows end-users to interact directly with smart contracts and thereby removing the need for trusted-third-parties. In cases where: ...
2
votes
1answer
62 views

function input conditional check

I have a function which is accepting a string argument as input parameter. This string is an IPFS hash and I would like to check that the input is actually just that and not a malicious link or the ...
2
votes
2answers
823 views

What is an example of Use a pattern where the recipient withdraws the money?

In the Solidity docs it says: There are some dangers in using send: The transfer fails if the call stack depth is at 1024 (this can always be forced by the caller) and it also fails if the ...
2
votes
1answer
317 views

How will the number of confirmations for security change with Casper?

How will this answer change when Casper is deployed?
2
votes
2answers
46 views

Revert()/throw/invalid are so powerful they can even put back an already self-destructed contract, but is there a way to surpass such limitation?

I know this sounds confusing so let me explain: In this case below a transaction will succeed and a contract will be first destroyed and then re-initialized on the same address (yes, I didn't think ...
2
votes
1answer
40 views

How to access a smart contract function protected by access rights using Web3?

I have a smart contract address for security tokens, and certain functions of it are protected by access rights, for which I have an address to access those functions, however I am not able to figure ...
2
votes
2answers
802 views

Getting ParserError: Expected ',' but got 'payable' and also one important security issue with contract

I have write a small smart contract for lottery system. however there is problem. please see below full code. pragma solidity >=0.4.22 <0.6.0; contract Lottery{ address[] public players; //...
2
votes
1answer
361 views

Keeping private key for signing transactions on a local server

Need an idea for not storing private key to sign transactions (on public server/database file system). The private key is needed to sign the transactions for transfer function ERC20 standard. To ...
2
votes
1answer
275 views

How to implement user deposits for tokens for an exchange

If we generate new deposit addresses for every user we face following problems: - we need to transfer tokens from individual wallets to our exchange wallets - we need to fund the wallets with ether to ...
2
votes
3answers
428 views

In ethereum, what happen if someone controls a large majority of mining power?

If someone manages more than 50% of the mining power, this situation necessarily compromises the integrity of the past blocks and newly generating blocks?
2
votes
2answers
79 views

Making a contract unreproducible

I want to make a contract, from a factory contract, that can't be replicated by contracts deployed by other addresses. The factory contract will be called by different addresses so signing a piece of ...
2
votes
1answer
636 views

Could private values be read by other contracts?

While studying blockchain interoperability (like BTC relay or a Dogecoin relay), it came to my mind that if the Ethereum blockchain can read another blockchain, we could use the same process to make ...
2
votes
1answer
258 views

testrpc security implications of opening mist with a custom RPC Port?

I am trying to use the testrpc, and one of the solutions I found was to run testrpc in one terminal window, and then run Mist --rpc localhost:8545 in another. When doing this, the following warning ...
2
votes
1answer
520 views

What are the identities of the Ethereum/DAO white hat hackers?

Who are the Ethereum/DAO white hat hackers? How can the community be assured that they can be trusted? Are they using the same exploit as the black hat hacker used? What prevents the white hat ...
2
votes
2answers
2k views

What does msg.sender.call() do in Solidity?

Hi was going through solidity documentation. There was some code that I was not able to understand, even after researching a lot I was not able to find some satisfactory output. The code is as under: ...
2
votes
1answer
378 views

How does this honeypot contract work?

I've been trying to pick this honeypot contract apart, but I haven't figured out exactly how it works. overview The premise is pretty simple, the contract is set up to look like a "new year's gift" ...
2
votes
1answer
173 views

(Ethereum Game) How can you prevent people from simply calling the contract function that adds xp to their character?

If you are creating a game where your character receives xp after every time they play, how can you prevent people from just calling the "addXP()" function from the contract and giving their player ...
2
votes
1answer
494 views

Which JSONRPC APIs are required by MetaMask?

This question is related to What RPC APIs are safe to expose? I want to run a Parity node not to have a wallet but only to have my own personal JSON RPC node for MetaMask. Parity will not be running ...

1
3 4
5
6 7
11