Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
1
vote
1answer
85 views

Implementing security feature on token contract

I am trying to implement a security feature on a ERC20 Token for the event of a vulnerability on it's code or the solidity core. This feature consists basically in two steps : First, the owner of ...
1
vote
1answer
924 views

RPC authentication in Ethereum?

As far as I understand Ethereum uses JSON-RPC to communicate between clients. What is the authentication mechanism? That is, how does the network know that the RPC request is coming from a legit ...
1
vote
1answer
643 views

How to use the Ledger Nano S hardware wallet without installing Chrome?

How can I use the Ledger Nano S hardware wallet with FOSS only and hence without having to install Google Chrome on my Debian machine? I'd like to use for it ethereum and altcoins.
1
vote
2answers
481 views

Is it secure to rely on 'now' or 'block.timestamp' for the deadline of an ICO?

I am planning on launching an ICO and have been reading through the security recommendations for writing solidity contracts. My ICO checks if the deadline has been reached by using if(now >= ...
1
vote
2answers
8k views

Is Trojan:Win32/Tilken.B!cl a real threat? Trojan horse on geth files

Windows Defender accused some geth and ethereum files to have a trojan horse called Tilken.B!cl file: C:\Program Files\Geth\uninstall.exe file: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\...
1
vote
2answers
300 views

Testing wallet password

I finally got my wallet to work. I am just wondering is there a way that I can test to ensure I remember the wallet password correctly? I mean the last thing that I want to send a large number of ...
1
vote
1answer
28 views

Is the “-=value THEN +=value” order only important for transfer() or for transferFrom(), too?

Concerning the transfer() function of a StandardToken: Since DAO "white hack" I know that it's important for contract security to substract the value first and then add it to the recipients balance. ...
1
vote
2answers
212 views

Wallets that sign transactions using true random numbers

From https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm: Another way ECDSA signature may leak private keys is when 'k' is generated by a faulty random number generator. It ...
1
vote
3answers
661 views

Pop-up instructing me to start Geth with “repccorsdomain” when running Mist on OSX?

Macbook Pro OS X 10.10.5 Mist/Ethereum-Wallet 0.8.1 Node type: Geth 1.4.10 (Go) When running Ethereum-Wallet I have been receiving this pop-up message (presumably from within the application) quite ...
1
vote
1answer
16 views

Information Regarding LASER and Ethereum

I was reading this article https://diligence.consensys.net/files/D1T2%20-%20Bernhard%20Mueller%20-%20Smashing%20Ethereum%20Smart%20Contracts%20for%20Fun%20and%20ACTUAL%20Profit.pdf and came across ...
1
vote
1answer
21 views

Difference between MythX and Mythril for security auditing

I know that both mythrix and mythril are used for smart contracts auditing but I didn't figure out yet the difference between them. I'll appreciate any help.
1
vote
2answers
26 views

How can I find out the sender's gas limit?

Is there a way to check Sender's Gas Limit? If the sender sets too low, I will just accept whatever gas amount that he had set and return immediately without hitting the limit. I am trying to ...
1
vote
1answer
24 views

Is it considered secure at all to use passwords and private keys in the code of smart contract?

Basically something like: function transfer(address to, string privkey) { if(privkey == "cd33434343...") { msg.sender.transfer(this.balance); } } The above is obviously flawed since the privkey is ...
1
vote
1answer
56 views

How mining happen in private and permissioned blockchain?

In public blockchain a miner gets rewarded for mining a block. But in a private or permissioned blockchain, if there are no rewarding facilities available, how does the mining happen? Also, is it ...
1
vote
1answer
52 views

Off-chain authorization system

I'm working on a dapp and am running into a dilemma regarding how to balance trustlessness with the cost of transactions for users. In order to reduce gas usage by users, I want to be able to able to ...
1
vote
1answer
43 views

Strict Balance Equality (Security Issue)

Research Paper, Page-5(Strict Balance Equality)I have read that attacker can use Selfdestruct() and forcibly send ethers to the contracts. My questions are: If Selfdestruct is meant for owner of ...
1
vote
1answer
134 views

Design pattern Checks-Effects-Interactions Pattern

I was workig on design pattern Checks-Effects-Interactions Pattern and found the below link which has a similar question but in the direction which I am looking at .. Checks-Effects-Interactions ...
1
vote
2answers
88 views

DappHub Multiply Function

Could someone explain the use of performing a multiplication such as this? I mean the logic is fine, but what is the importance from a security point of view? function mul(uint x, uint y) internal ...
1
vote
1answer
57 views

Cannot send transactions

I have a online shop where users can recieve ETH and do shopping. So to have a secure wallet, I have created an offline service which generates xpub and xpriv which I use to generate addresses in my ...
1
vote
1answer
44 views

Provide security wallet

I have a service where users can buy my product. Besides paying by card, I want to be able to allow users to pay in ETH. I think that it will correctly generate addresses for each user so that it is ...
1
vote
1answer
24 views

Is attaching a name to an Ethereum address a “faux pas?”

I'm currently working on a DApp right now, and I was curious if it's considered poor design to include a string with the user's name that is mapped to a particular address. A user who has access to ...
1
vote
1answer
86 views

Can emitting an event after a state change cause a reentrancy attack vulnerability?

Is the following function vulnerable to a reentrancy attack? function withdraw() public { uint amount = pendingWithdrawals[msg.sender]; // Remember to zero the pending refund before // ...
1
vote
1answer
307 views

How does the exploit in FOMO3D work?

With the recent release of the FOMO3D exploit in its smart contract, how does the exploit work?
1
vote
1answer
119 views

How are encrypted Oraclize queries protected against replay attacks, precisely?

The Oraclize API allows users to encrypt a query or part of a query using their public key "to protect data from public scrutiny," to quote their documentation. The documentation has this to say ...
1
vote
1answer
104 views

Malicious node returning tampered data?

I understand concepts about how consensus is important to record data into the blockchain such that it is accurate and not tampered with. But, suppose a client queries the balance of an account, and ...
1
vote
1answer
561 views

BFT vs On-chain POW

What significant advantages does BFT provide over On-chain POW solutions and why or why not are they not more commonly used?
1
vote
1answer
96 views

How to Include a Lock that will Stop Your Tokens from Being Listed on Exchanges?

We are working on a security token sale and are aware we may need to be able to "lock" our tokens, not from being transferred from person to person but from being listed on any exchanges decentralized ...
1
vote
1answer
199 views

Does running a light client add extra security for Ethereum compared to doing nothing?

These may answer the question: https://github.com/ethereum/wiki/wiki/Light-client-protocol https://blog.ethereum.org/2015/01/10/light-clients-proof-stake/ Of course you want to be secure, but ...
1
vote
1answer
318 views

Best practices for a secure Ethereum private network? [closed]

What are the best practices for an Ethereum private network with n nodes (programmed with Geth), to be secure from possibles external attacks? I mean, which config parameters are recommended during ...
1
vote
1answer
245 views

How external functions call works in Solidity? Synced or Asynced?

function redeem(uint256 _token) public { // transfering the token from tokenholder to owner token tokenBalance = token(tokenAddress); tokenBalance.transferToOwner(owner, _token); // ...
1
vote
1answer
25 views

What would happen if someone tried to use Ethereum with a modified version of the client?

Let's say that I try to use Ethereum with a modified version of the client which does not follow all the rules of the protocol. What stops my client from being able to damage the Ethereum network?
1
vote
2answers
139 views

Do I have to worry about signing transaction?

I'm using truffle & ganache to test a simple voting app. Do I have to worry about security and transaction signing or is it managed for me ?
1
vote
1answer
881 views

ETH stolen from two MEW wallets & moved to an unknown address & then to ShapeShift

I recently found out that my ETH funds were stolen from two MEW wallets and moved to an unknown address. Below are addresses of my two MEW wallets. 1) 0x16bf750Ee569F0A173BCCfD7b3F92F9Bb46c6AfC (...
1
vote
1answer
383 views

Are there weaknesses in using Oraclize (or similar) for randomization?

I'm trying to learn about Ethereum Smart contracts and studying example code and existing Dapps. If I understand things (and I probably don't), Solidity cannot create random numbers, so developers ...
1
vote
2answers
701 views

Feasibility of blacklisting addresses

Probably a very naive question, but when attacks occur such as the etherdelta one yesterday, what's stopping having a system in place to basically freeze assets in a certain address before the ...
1
vote
1answer
22 views

Coinbase deposit PLZ HELP [closed]

I deposited $ into Coinbase from my bank account, however the money hasn't cleared yet and it will only be available in 7 days. Do I get the price of ETH BTC LTC when I clicked 'BUY' (although it hasn'...
1
vote
1answer
182 views

Unable to replicate short-address attack

I was reading about the short address attack and decided to replicate and test the possible solutions. What I know about short address attack is if you skip n characters of your address, you end up ...
1
vote
1answer
43 views

Is holding REP safe in address from which REP/Ether has been srnt?

Is there any reduction in security with holding REP in address after a transaction out (to exchange for example) has been made? Could the key to address be revealed or compromised, assuming using ...
1
vote
2answers
139 views

Contract variable changes prediction

I believe this is a very simple question, but i couldn't find a direct answer in documentation or google. I'm new to solidity/ethereum and maybe i don't fully understand some core concepts yet. So, ...
1
vote
1answer
85 views

Smart Contract security concerns. Is Lothereum fail proof?

Googling around I found this on gitter. Is this drawing process uncrackable? How can I consider it safe or not to use it? How would you guys evaluate that?
1
vote
1answer
158 views

How do short confirmation times negatively contribute to blockchain security?

The Ethereum whitepaper states: The motivation behind GHOST is that blockchains with fast confirmation times currently suffer from reduced security due to a high stale rate - because blocks take a ...
1
vote
2answers
802 views

Ethereum Contract auditing(solidity)

I am a student of Information Security and my teacher has given me the task to know about the details of auditing that is being done on Ethereum smart contracts that are written using solidity. ...
1
vote
1answer
233 views

How does Ethereum/Solidity handle overflows in contracts?

Say I have a smart contract with variable of type uint256. I write a function to increment this variable. How does the EVM handle trying to increment the variable to store values beyond 256 bits? ...
1
vote
1answer
103 views

Why not enforce “external calls last” policy syntactically (or in compiler) to prevent reentrant attacks?

From the docs: Write your functions in a way that, for example, calls to external functions happen after any changes to state variables in your contract so your contract is not vulnerable to a ...
1
vote
2answers
1k views

keystore file without password of account can be a problem?

In mist you create an account and you provide password. Now your keystore files have been accessed by unauthorized people but not your password which is in your head and only there. Can your ethers be ...
1
vote
1answer
240 views

Is an RPC-enabled Geth with no accounts secure?

For my dapp, I want to host a web server (Geth + web3) which allows the users to relay the transactions they signed "offline". Is this safe? Are there other (than unlocked accounts) security concerns ...
1
vote
1answer
115 views

User Management in private ethereum block chain app

I am doing a POC block chain application, not a crypto currency once. I saw many examples determining user by using msg.sender attribute, my question is can we manage users in block chain app like we ...
1
vote
1answer
459 views

Is it possible to hide the state of a contract and information from transactions calling its methods?

I am interested what is the best way to hide contract function calls and contract state details from everyone except certain parties (if that is possible at all). Encryption sounds like a possible ...
1
vote
1answer
33 views

How does this function potentially violates the Checks-Effects-Interaction pattern?

I am developing a smart contract that integrates with the DAI stable coin. In the function below, you can see that I have followed the check effects interaction pattern, so how come I still get a ...
1
vote
0answers
17 views

How dangerous is this: number of contracts contain a function like “approveandcall” which lets anyone call any contract (some thoughts?)

The most common implementation is as follows: function approveAndCall(address _spender, uint256 _value, bytes _extraData) public returns (bool success) { tokenRecipient spender = tokenRecipient(...

1 5 6 7 8 9 11