Questions tagged [security]

Questions relating to application security, safety, trust, and attacks against the Ethereum software stack and blockchain system.

Filter by
Sorted by
Tagged with
1
vote
0answers
24 views

Sending secure transactions using web3.py

An ethereum account I had has been hacked, where whenever I send it, say, 0.1 eth, some evil bot immediately sends 0.0009 eth from that account to a dummy account, and then spends the remaining 0.0991 ...
1
vote
1answer
36 views

How does this function potentially violates the Checks-Effects-Interaction pattern?

I am developing a smart contract that integrates with the DAI stable coin. In the function below, you can see that I have followed the check effects interaction pattern, so how come I still get a ...
1
vote
0answers
17 views

How dangerous is this: number of contracts contain a function like “approveandcall” which lets anyone call any contract (some thoughts?)

The most common implementation is as follows: function approveAndCall(address _spender, uint256 _value, bytes _extraData) public returns (bool success) { tokenRecipient spender = tokenRecipient(...
1
vote
1answer
30 views

Are simultanous transactions possible (basic but potentially very dangerous security concern…most likely impossible…)?

Long story short I am curious how a contract stores variables in memory, so is it possible to spam say 100 transactions at once and the values to be changed afterwards...I am sure I am giving bad ...
1
vote
1answer
40 views

How are transfer and send protecting against reentrancy if the gas is taken from the EOA (msg.sender)?

I guess transfer and send simply allow 2300 gas but no gas is taken from the contract? In other words if a wallet calls this function with say one million wei gas: function sending() public payable { ...
1
vote
0answers
27 views

Is there a curated list of known security vulnerabilities related to escrow?

In Factories Improve Smart Contract Security, Steve Marx says that: This bug was hand-picked to show the benefit, but this bug is representative of a large class of bugs around escrow. In my ...
1
vote
0answers
37 views

Help hacking this contract

This is a very simple contract that I can't hack and I'm stuck, I need some help to get the concepts right. pragma solidity ^0.4.10; contract SimpleToken { mapping(address => uint) public ...
1
vote
1answer
27 views

Risk of Messages Not Having a Signature

As per my understanding transactions are signed before sending to Ethereum. Else, no transfer of Ether will happen. However, messages sent to Smart Contracts (SC) aren't signed (e.g., using methods....
1
vote
0answers
14 views

How exactly theᴅᴀᴏ reentrancy hack was performed without having weiGiven>0 nor IsAllowed(WithdrawAddress)?

The well known ᴅᴀᴏ hack didn’t affect ether balances of theᴅᴀᴏ but balances of rewardAccount. That’s why I’m talking about the hack version which affected contract balances of theᴅᴀᴏ itself. With ...
1
vote
1answer
45 views

adaptive vs. non-adaptive adversaries? Is there a precise, unique and general definition? (Updated)

In this Ethereum github page (Link to the page: https://github.com/ethereum/wiki/wiki/Sharding-FAQ#what-are-the-security-models-that-we-are-operating-under) there is a very brief definition of the ...
1
vote
0answers
16 views

Understanding a simple online contract which seems not functional

I am writing to understand the functionality of this contract (https://etherscan.io/address/0x1f14b77e9f4844889fa63bc1e5180c8b90ec18db), this does not look even "functional" to me. Here is the ...
1
vote
0answers
29 views

What are the drawbacks of layer 2?

The scalability trilemma states that a blockchain can only have two out the following three properties: decentralization, scalability, and security. Layer 2 protocols aim to make Ethereum more ...
1
vote
0answers
63 views

The blockchain trilemma

I understand that the generic blockchain faces a problem where it can choose to optimize between scalability, security and decentralization. I can see easily why scalability and decentralization are ...
1
vote
0answers
70 views

What possibly could go wrong if I leave my private blockchain node 30303 port open to public? [duplicate]

I have the following setup: All the nodes inside my cluster are talking to each other via 30303 port. When I want to talk to them, I'm using a Geth light client via HTTP JSON RPC port 8545. Only the ...
1
vote
0answers
45 views

Is there a more elegant way to do an aggressive multi-send?

I understand there are many approaches to do multisend but for me timing is a priority and I do not want to stop the transaction if a address.send fails. function multiSend() internal isAdmin { ...
1
vote
0answers
92 views

secure open source Payment Gateway [closed]

I'm working on an open source multi coin payment gateway. ETH, EOS, BTC and BCH will be supported. My plan so far: The nodejs API runs on DigitalOcean. You send a GET request with your preferred ...
1
vote
0answers
40 views

GETH accounts imported without my knowledge

I expose only port 30303, not 8545. But when I issue commands eth.accounts. I found these accounts were imported without my knowledge: "0xe4fe1fb7e693c529f5a95dd8b1714d1acfdbd058", "...
1
vote
1answer
65 views

Access manager in Smart Contract

I'm building a service where one can publish a crypted file on the internet which can be accessed and decrypted by people allowed. I don't want to store any crypted key on a server or something. For ...
1
vote
0answers
37 views

MIME types in Ethereum

Yesterday evening, an individual(at a french meetup haha) asked me what ethereum was and kept asking me if there was something similar to MIME types on Ethereum. I did not know what MIME types were ...
1
vote
1answer
204 views

Using Hardware Security Modules to generate and store private keys on private ethereum / quorum

For a private ethereum networks, has anyone used Hardware Security Modules (HSM) to generate and store Ethereum private keys? I am keen to know how public/private keys are managed without a PKI (...
1
vote
0answers
99 views

Unlock account on Ethereum client, or sign every transaction sent it to Ethereum client?

I have a contract which needs to be updated occasionally. For this purpose, I set up an Ethereum client, namely, a Parity node. At this point, I see several ways of carrying out the specified task: ...
1
vote
1answer
51 views

Account management risks of booting into Tails OS from USB using a “partially air-gapped” Linux PC

My threat tolerance is around a 3 out of 5 on the paranoia scale. What are the practical account management risks of using a flash drive loaded with Tails OS to boot into a Linux PC, which will only ...
1
vote
2answers
317 views

How does ethereum bypass the NAT

I wonder, since Ethereum is based on a decentralized p2p network, how does it get through the NAT Firewall? There is no server Ethereum can connect on, so there has to be a way for nodes to accept ...
1
vote
0answers
24 views

security and implementation challanges when launching the token

I would like to know what are security holes when launching an ERC20 token or other tokens. Below is my process of launching token: Creates an ERC20 token contract with truffle. Defines network ...
1
vote
2answers
421 views

Automatic transaction

I would like to know if it was possible to automatically send any ETH amout to an address "B" just after receiving them on an address "A"? Maybe via a script? I need help
1
vote
2answers
39 views

Dos with revert

While I was reading a guide on smart contract security (by consensys) I found this: // INSECURE contract Auction { address currentLeader; uint highestBid; function bid() payable { ...
1
vote
0answers
32 views

Are API tokens incompatible with Ethereum apps?

I want to build an Ethereum app that gets weather data from a trusted (government run) API via oracilize. This service requires an API token to be sent with each request to prevent abuse. Each API ...
1
vote
0answers
29 views

Build blockchain application that has some off-chain functionalities

I am learning about blockchain and I have a general question. Let's say that I want to build my custom blockchain based on Ethereum. My implementation has many nodes and few of them are chosen ...
1
vote
1answer
172 views

Implication of hacking into an ethereum node on proof of stake

It is my understanding that in proof of stake, the validator puts up a stake that gets slashed if they don't respond to requests truthfully. In the scenario that someone hacks into your node, wouldn't ...
1
vote
0answers
331 views

Is it safe to use web3.eth.accounts.create() in frontend?

web3.eth.accounts.create returns the address along with private key so I was wondering if is it safe to call it using plain JS in website frontend instead of doing it server side in Node? My use case ...
1
vote
0answers
48 views

How to limit transactions to only approve addresses?

I am dealing with a private consortium scenario (private Ethereum network) where all participants are known in advance and have assigned an addresses used in genesis. Like to know if its possible to ...
1
vote
0answers
107 views

Tracking transaction attempts/failed attempts sent to a contract from unknown parties

In light of the recently killed parity library and how the person responsible went around randomly trying to kill contracts, is there a way of monitoring smart contracts for attempted and potentially ...
1
vote
0answers
411 views

How do I backup my wallet

I'm using the Ethereum Wallet. When I click - File > Backup > Accounts, it does nothing. Can't see the UTC keystore files in AppData\Roaming\Ethereum Wallet What am I doing wrong? I have 1 ...
1
vote
0answers
93 views

Solidity — refactor simple contracts to fix gas limit and avoid Checks-Effects-Interaction warning

The following pattern is something that recurs a lot in the contracts I am develping and when I run an analyser over it I get a couple of warning. Say I have two contracts as follows: pragma ...
1
vote
0answers
296 views

Build secure private ethereum blockchain with geth!

I have read on the StackExchange how to build a private blockchain in LAN with private IPs and geth clients. As I understood to communicate in lan the geth peers need for P2P communication the form ...
1
vote
0answers
61 views

Hidden gameplay information for game contract [duplicate]

I developed a maze game in Solidity with a treasure at a location in the game. Players send transactions to move. The first to find the treasure wins some ether. Is there no solution to the problem ...
1
vote
1answer
1k views

Is it possible to hack an ethereum account? [duplicate]

I want to know if is it possible to hack an Ethereum account?
1
vote
0answers
283 views

Abstraction and ACL in a smart contract

I have two smart contracts, say Admin and Subject. For this purpose lets assume that ten unique accounts have deployed 10 such Admin contracts. One Subject contract has been deployed which has a ...
1
vote
0answers
135 views

Are there any real examples of Sybil attack? [closed]

I have seen many articles and blog posts talking about Sybil attack but except the case of Tor (Article Link), i couldn't find any relevant articles pointing to the Sybil attack on Computer Networks ...
1
vote
0answers
20 views

Is it secure to call function without any encryption? [duplicate]

I mean, if I have a contract with function like: string current_password; function set_password(string password, string new_password) { if (password == current_password) { ...
1
vote
0answers
52 views

Implementing redundancy in smart contract to prevent unwanted behavior and vulnerabilities [closed]

One of the design philosophy that help the airline industry to achieve such a high safety record was the "redundancy philosophy". Each critical computers are designed to be fully redundant. That mean ...
1
vote
0answers
44 views

Smart contract vulnerability handling [duplicate]

Any piece of code will have some degree of vulnerability, and any such code that attracts any level if attention is bound to be exploited through these vulnerabilities. In conventional (centralised)...
1
vote
0answers
269 views

How is transaction finality correlated with transacted amount?

It was argued by Vitalik Buterin that transaction security can be a function of the amount the transaction carries. This is because of the economics of attacks. How many block confirmations would you ...
1
vote
3answers
45 views

Is it possible to deploy a contract on the same address after self-destruct?

As far as I understand self-destruct simply deletes the code from a contract and turns it into a regular wallet + it sends all funds to caller/argument. But is there a way to recreate the contract? I ...
0
votes
3answers
54 views

How do I attack the `Vuln` contract?

How can I steal from Vuln contract? I have made another contract to try to steal from Vuln but it always gives me an error. And I'm not sure how to send the money to my adrress. contract Vuln { ...
0
votes
4answers
2k views

Generating lots of private key means I can hack someone's ether?

If I generates lots of private keys, I can get someone's address and its digital signature, right? I know that there's 2^256 possible private keys, but what if I use brute-force attack? Is it ...
0
votes
2answers
117 views

Is it safe to remove the “view” modifier from the function “getTokenAmount” in the OpenZeppelin crowdsale contract?

This function from the openzeppelin crowdsale sample is marked view as seen here: // Override this method to have a way to add business logic to your crowdsale when buying function getTokenAmount(...
0
votes
1answer
67 views

Can a miner compromise an EVM that runs a smart contract?

For example, there is a private storage variable which cannot be seen by any user during the execution of the smart contract. When a miner runs the smart contract in a local EVM, can it infer the ...
0
votes
1answer
997 views

ERC20 tokens taken from MyEtherwallet

99% of my ERC20 tokens have all been taken out of Exodus Please someone help me! After one day of registering with myetherwallet my tokens went missing... I bought 10 differnt ERC20 tokens in ...
0
votes
1answer
34 views

Is it safe to share Smart Contract code from GitHub with developer?

Hi We have finished our smart contract development and are looking at candidates for a security audit Is it safe to share our GitHub repo with a smart contract developer in order for him to give ...