Skip to main content
8 votes
Accepted

What's the vulnerability in my contract?

It sounds like you are being front run. This means that a bot is watching you send a transaction, reading the input (specifically, _answer), and submitting a transaction with the correct answer but a ...
Shane Fontaine's user avatar
7 votes
Accepted

How does Poly Network hack work?

The following is taken from these two sources: Twitter thread from Kelvin Fichter (link) report from Peckshield (link) Basically, Poly has a contract which is in charge of verifying that that it's ...
The Renaissance's user avatar
6 votes
Accepted

What happens if two different states of smart contract conflict?

People have been explaining this since Bitcoin emerged on the scene but it's a little difficult to grasp at first and usually takes a few explanations from a few angles, so I'll try for an overview ...
Rob Hitchens's user avatar
  • 55.4k
3 votes

Do view functions cause reentrancy vulnerabulity?

Funnily enough I just came searching for an answer to this myself. As I understand it, there is no reentrancy vulnerability in a conventional sense because a view member cannot modify state.
Tim Clancy's user avatar
3 votes
Accepted

Do view functions cause reentrancy vulnerabulity?

Calls through view members of interfaces are done through STATICCALL opcode. As my experiment confirmed Solidity 0.6.0 does use STATICCALL in this case. https://github.com/ethereum/EIPs/blob/master/...
porton's user avatar
  • 1,804
3 votes
Accepted

An unlocked wallet is holding 100% of <PAIR> LP

It means the owner can rug pull(remove liquidity, steal everyone's investment, and make the token valueless) any time. That is why that prompt exists. Locks are commonly done on DxSale and Poocoin ...
bru53001's user avatar
  • 721
3 votes
Accepted

By what duration can a miner manipulate block.timestamp?

There is no written rule on this, miners and full nodes can set themselves what kind of block timestamp skew they tolerate. In practice, there has not been any notable timestamp skew ever. The block ...
Mikko Ohtamaa's user avatar
3 votes
Accepted

What is the "pre-commit" scheme to defeat frontrunning attack?

Let's suppose you have a raffle and can reserve a number contract Raffle { mapping(uint256 => address) reserved; event Reserved(uint256 value, address owner); function reserve(...
Ismael's user avatar
  • 30.5k
3 votes
Accepted

Are solidity contracts still vulnerable to callstack exploits?

This attack was eliminated for all practical purposes by EIP 150, which was implemented in October, 2016. For details see How does EIP 150 change the call depth attack?
Edmund Edgar's user avatar
  • 16.9k
2 votes

Vulnerability to Meltdown and Spectre?

No. At least not as far as the EVM and contracts are concerned. The EVM has too much overhead and lacks the constructs needed to exploit either of these bugs.
DeviateFish's user avatar
  • 1,128
2 votes
Accepted

Understand the trending of newly-uploaded smart contracts that is considered as vulnerable

A few ideas, but nothing concrete. Might be verging on the speculative... we randomly... How? Are you using a source that lists all contracts deployed in the time period? Or are you just ...
Richard Horrocks's user avatar
2 votes

What is the recommended procedure to report potential vulnerabilities in a smart contract?

Technically speaking, there's nothing you can do. The code is immutable and it will stay like that forever. Socially, there's a lot which can be done. In most cases, a comment should be enough, ...
Paul Razvan Berg's user avatar
2 votes
Accepted

Can the contract with the stolen Ether be attacked the same way like the DAO?

This would have been possible if at least one honest actor would have voted for this split. Since the attacker is most likely the only shareholder and the curator of this DAO the same attack can not ...
q9f's user avatar
  • 33k
2 votes

Is the ethereum.org/dao contract vulnerable to recursive call attacks?

Yes! the attacker would have to use a call in his wallets fallback function and call the function again so he will be able to detract the money within the same recursion call, before p.executed = true....
Roland Kofler's user avatar
2 votes

How does Poly Network hack work?

Poly Network smart contract performing bridged arbitrary (user-defined) calls on behalf of users had an ownership on locked (bridged) tokens vault smart contract. Hacker bridged fake call to make this ...
k06a's user avatar
  • 3,036
2 votes

An unlocked wallet is holding 100% of <PAIR> LP

If it says: An unlocked wallet is holding 100% of the lp. This means that the owner of the token can at any time get his liquidity and devalue the token. Therefore, you need to block liquidity, for ...
Artem's user avatar
  • 41
2 votes
Accepted

Detection of same function reentrancy vulnerability

In that case they verify correctness, defined by the authors as adherence to safe programming practices What they are effectively testing is the root cause of reentrency vulnerabilities: not ...
hroussille's user avatar
  • 7,751
2 votes
Accepted

Locked Ether in EOA Account: Fake Contract Address

Maybe the word "fake" was not the correct one to use in that scenario. Let's take a look at this way of deploying a contract from another contract taken from solidity-by-example: ...
Jeremy Then's user avatar
  • 4,619
1 vote
Accepted

What if a chain is compromised?

From xDai bridge docs: The bridge uses smart contracts on both chains to process transfers, and a group of validators confirms bridge transactions. When a bridge transfer is initiated, the specified ...
hack3r-0m's user avatar
  • 1,919
1 vote

What if a chain is compromised?

First point here would be to understand your goal for using a sidechain. I assume you possibly need to either increase scalability or minimise gas fees. If that is the case, then you have a number of ...
Sergi Juanati's user avatar
1 vote

Do view functions cause reentrancy vulnerabulity?

View functions cannot modify the state, as specified here. It means that they cannot make any permanent change to the blockchain such as changing the ether or tokens balances. Therefore, reentrancy is ...
Undead8's user avatar
  • 3,610
1 vote
Accepted

How to properly invalidate the manager?

This would work great! The invalidate() function is public, meaning anyone can call it. If you want to restrict who can call that address, you should add some require statements. For example, if you ...
Shane Fontaine's user avatar
1 vote

Deploy basic proxy with arguments

I think a case could be made that this concern is a non-issue. Remember, the initialized state is in your proxy. Someone else can DELEGATECALL to your contract and it will, at first, seem ...
Rob Hitchens's user avatar
  • 55.4k
1 vote
Accepted

Problem with reading balance

When the caller is an smart contract if it can re-enter BuggyWithdraw and can change balance[msg.sender] then it will be possible that BalanceDecreased is never emitted. So an off-chain service that ...
Ismael's user avatar
  • 30.5k
1 vote
Accepted

Use of interface in tx.origin

No, it is not necessary. Its use is unrelated to tx.origin vulnerability. I think the idea of the question was to have two files: Victim: contract TxUserWallet Attacker: interface TxUserWallet, ...
Ismael's user avatar
  • 30.5k
1 vote
Accepted

Gasless Send: Keeping of Ether Wrongfully

If somebody calls function pay of a C instance with the address of a D1 instance: The C instance is supposed to send n wei to the D1 instance As a result of d.send, the fallback function of the D1 ...
goodvibration's user avatar
1 vote
Accepted

How is it possible to print tokens out of nowhere with the batchOverflow problem?

totalSupply stores the current amount of minted tokens, not the maximum amount of tokens which can be minted. In order to restrict this amount, one needs to apply additional code (not part of the ...
goodvibration's user avatar
1 vote
Accepted

Why does the MESH token is stated to be vulnerable on the recent overflow bug of some ERC20 contract?

In the transferProxy fucntion, if(balances[_from] < _fee + _value) revert(); can cause overflow error. They didn't check _fee + _value is less than 2^256. So when you set REALLY big number on ...
Kronos's user avatar
  • 896
1 vote
Accepted

Upgradable Smart Contracts - Is there consensus between shareholders when upgrades occur?

As always there is no silver bullet. Different features with different tradeoffs between maintainability, complexity, and trust are possible: Who can upgrade? nobody - impossible to upgrade/evolve ...
ivicaa's user avatar
  • 7,519
1 vote
Accepted

Is a 'sign on the dotted line' attack (confirm incorrect address) possible on the Ledger Nano S?

It's not possible. The application that the ledger is interacting with constructs the transaction and sends it to the Ledger. The Ledger then displays the address for you to verify. You verify it ...
natewelch_'s user avatar
  • 12.2k

Only top scored, non community-wiki answers of a minimum length are eligible