Questions tagged [vulnerability]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
0answers
34 views

Help hacking this contract

This is a very simple contract that I can't hack and I'm stuck, I need some help to get the concepts right. pragma solidity ^0.4.10; contract SimpleToken { mapping(address => uint) public ...
3
votes
1answer
32 views

What is the “pre-commit” scheme to defeat TOD attack?

I am writing to inquire feasible strategies to defeat Transaction Ordering Dependence (TOD) bugs. I learned from the best practice guideline such that we can use a so-called "pre-committed" scheme ...
0
votes
1answer
11 views

Use of interface in tx.origin

I have found a link for replaying tx.origin vulnerability at: Unable to replicate tx.origin I can’t understand the use of interface. Is it necessary to use interface? I am also getting a syntax ...
1
vote
1answer
45 views

Gasless Send: Keeping of Ether Wrongfully

I got following code from: A survey of Attacks from Ethereum Smart Contracts contract C { function pay(uint n, address d){ d.send(n); } } contract D1 { uint public count = 0; function()...
0
votes
1answer
22 views

Does the Wallet Griefing Attack still Exists?

I read about Wallet Griefing attack at the following link: [Ethereum Griefing Wallets][1] 'send' is checked but contract uses throw. The code is given below: for (uint i=0; i<investors.length; i+...
1
vote
0answers
26 views

Example of Signedness Bug in Smart Contracts

I found an example of underflow bug at: Catching Vulnerable Smart Contracts Once and for All contract UnderflowAttack { ... function withdraw (uint amount) public { require(balances[msg.sender] -...
1
vote
1answer
15 views

Detection of var vulnerability: problem with search string

SmartCheck tool at: SmartChek: Static Analysis of Ethereum Smart Contracts suggests detection of 'var' key word in the smart contract by searching the assignment statement such that the Left Hand Side ...
0
votes
2answers
28 views

how does this honeypot works?? 'OpenAddressLottery'

/** * Source Code first verified at https://etherscan.io on Saturday, February 10, 2018 (UTC) */ pragma solidity ^0.4.19; /* * This is a distributed lottery that chooses random addresses as lucky ...
1
vote
0answers
14 views

(solved) test forcing ether send, but not working

i want test forcing ether send to contract that without payable function. mastering ethereum_chap 9 in this page, we can send ether forcibly with contract's selfdestruct function. first, make deposit ...
0
votes
1answer
11 views

How is it possible to print tokens out of nowhere with the batchOverflow problem?

As stated in the title I've been looking at the Batch Overflow issue that happened last year where someone printed tokens out of nowhere. I see that when you create a token, you specify a totalSupply ...
1
vote
2answers
33 views

Why isn't this a vulnerability in openzeppelin's ERC-20 implementation (no allowance check)

openzeppelin's implementation of and ERC-20 token is as follows: function transferFrom(address from, address to, uint256 value) public returns (bool) { _transfer(from, to, value); _approve(...
3
votes
1answer
41 views

Understand the trending of newly-uploaded smart contracts that is considered as vulnerable

We tried to use Oyente to analyze some online contracts and drawed a diagram regarding the potentially vulnerable smart contracts ("reentrancy" bug) with respect to their creation time. So the y-...
0
votes
1answer
24 views

What is the recommended procedure to report potential vulnerabilities in a smart contract?

I was browsing etherscan's verified smart contracts (i.e. the ones with the source code attached), and I saw that one of the smart contracts contain (or at least I think it contains) a potential ...
1
vote
2answers
107 views

Why does the MESH token is stated to be vulnerable on the recent overflow bug of some ERC20 contract?

Has you know, there were a recent vulnerability which allowed creation of units for anyone in some ERC20 contracts. However, I’m failing to find the stated vulnerable code for MESH. Does it means it ...
3
votes
1answer
152 views

Upgradable Smart Contracts - Is there consensus between shareholders when upgrades occur?

It seems that upgradable smart contracts are the new wave of the future seemingly for the all the right reasons. How does this work for the "hello world" smart contract where two users make a bet on ...
1
vote
1answer
99 views

Is a 'sign on the dotted line' attack (confirm incorrect address) possible on the Ledger Nano S?

I'll describe a physical case of what I'm asking about -- we might call it the 'Just sign on the dotted line' attack. I'm asking if it's technically possible since one is required to open the hardware ...
0
votes
0answers
151 views

Any possible threats of making a private key of a testnet (Ropsten) available to public

I'm about to publish a sample Dapp (with source code) and would like to provide an account and its private key available in the source code to make the life easy for anyone trying to use it. This ...
3
votes
1answer
257 views

Vulnerability to Meltdown and Spectre?

Being a distributed computing platform, is Ethereum vulnerable to Meltdown and Spectre attacks?
-2
votes
1answer
259 views

Smart Contract for trustless presale pooling [closed]

I tried writing a smart contract, but I can't test it on testnet. Also, I am concerned about its vulnerabilities as I am not so experienced with how smart contracts behave in some situations. So here ...
1
vote
2answers
370 views

Solidity: order of lines with addition and subtraction operations

After looking at many different custom token contracts I noticed that the standard of transferFrom() function is as follows: function transferFrom(address _from, address _to, uint256 _value) public ...
1
vote
0answers
36 views

How are Ethereum security bugs fixed? what is the process?

When a security vulnerability (or a high risk bug) is found in Ethereum code. What are the actual steps of detection, report, fix and deployment that are in place to resolve the issue? Are the bugs ...
0
votes
1answer
36 views

Ether stolen from contracts

Can anyone explain what is exactly the point of this claim https://medium.com/@rtaylor30/how-i-snatched-your-153-037-eth-after-a-bad-tinder-date-d1d84422a50b
3
votes
1answer
897 views

Are solidity contracts still vulnerable to callstack exploits?

I was reading the paper at http://www.comp.nus.edu.sg/~loiluu/papers/oyente.pdf and it mentions callstack bugs where since the call depth is set at 1024, a contract may be able to call itself 1023 ...
2
votes
0answers
162 views

Contract with default function that uses more than 2,300 gas

I'd like to make a smart contract that I can interact with that I can do two things with: Be able to send Ether from it to a presale smart contract Has a default function that uses more than 2,300 ...
2
votes
1answer
54 views

Can the contract with the stolen Ether be attacked the same way like the DAO?

Since the Ether of the attacker is in a copy of a theDAO contract - can the ETH be stolen the same way?
4
votes
1answer
195 views

Is the ethereum.org/dao contract vulnerable to recursive call attacks?

Does putting p.executed = true after p.recipient.call() make this vulnerable to recursive calls? function executeProposal(uint proposalNumber, bytes transactionBytecode) returns (int result) { ...