Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

For questions relating to the security of the blockchain, contracts and dApps.

0
votes
0answers
15 views

How does EOS check that signature is canonical? [closed]

What algorithm is used for checking that signature is canonical?
0
votes
1answer
46 views

How can I remove or disable eosio development key and assign permission for another account as super users

Because it's for security reasons...It seem like disable Administrator on Windows Server. Please advise, Thank you.
2
votes
1answer
180 views

A possible alternative sign in/login process instead of firebase auth / amazon cognito using an eos contract?

I had the the idea of a secure alternative login process using an EOS smart contract instead of firebase or Amazon cognito. I would like to know if something like this feasible? My idea is somewhat ...
2
votes
1answer
35 views

Can one provably disable user-initiated transfers from an account?

In this scenario a deployed smart contract should have and retain full control of the funds (excluding BPs of course) on the account. How can one stop transfers from an account by the account owner? ...
1
vote
0answers
26 views

Hold funds for a time period with no possibility of contract's owner/author stealing them

if I write an EOS smart contract such that party A can send EOS to party B, but the contract will hold the funds for (say) 48 hours before releasing them to party B, can I do this in a way that would ...
4
votes
1answer
45 views

How can you make sure you know what the contract does when you send an action?

Say you want to send an action to a smart contract, and you know the WASM of the contract. You somehow obtained the original source code which was in C++, you compiled it to WASM, and you got the same ...
1
vote
1answer
36 views

Key derivation functions (KDF) with EOS private key

For our application we would like to derive hundreds of keys from an EOS private key without compromising the key. Is there any way to do this in EOS currently or any recommended external library to ...
3
votes
1answer
254 views

How does EOS prevent one contract from accessing another contract's tables without authorization?

I noticed that multi-index (which is under eosio namespace) uses the following to prevent access to another contract's tables: eosio_assert( _code == current_receiver(), "cannot create objects in ...
7
votes
2answers
238 views

Is there a flaw in deciding who can pay for RAM?

Lets say I interact with an action from a smart contract, if I'm not careful and didn't read or couldn't understand the source code for the smart contract, is it not possible that the contract could ...
4
votes
1answer
39 views

What are the worst cases if I allow my contract to call an evil action of an evil contract?

I am considering to allow my contract to call the transfer action of a user specified contract. I would like to know what are the worst cases that can happen with this design. My contract code will ...
2
votes
0answers
48 views

How to compile keosd with Secure Enclave support?

I've followed the steps outlined here https://github.com/EOSIO/eos/issues/4604 and gathered the required info. I'm trying this on a Mac with T2 chip. For Step 3, how should I modify the eosin_build....
4
votes
1answer
113 views

What's the best way to prevent overflow/underflow attack?

In Solidity, people use a SafeMath library to prevent overflow/underflow attack. So, I wonder what's the best way to prevent overflow/underflow attack for EOS contract. Is there an easy-to-use ...
3
votes
1answer
83 views

Can a plugin be configured to only process irreversible blocks?

We would like to implement a custom plugin within our own node, in order to listen to transactions from the main net, and then push relevant information to external services. However, we are ...
6
votes
1answer
107 views

Is delegated Proof of Stake vulnerable to government censorship?

EOS uses delegated Proof of Stake, Dan's innovation used also in previous graphene blockchains such as Bitshares and Steem. I was reading commentary from a blockchain news and commentator, Bruce ...
4
votes
1answer
121 views

360 Security Bug Claim. Truth or FUD?

Coingape reported that Internet Security Giant 360 found an Epic Secutiry Bug in EOS. According to the article, "remote attacks on its blockchain platform can directly control it and take over all ...
13
votes
1answer
247 views

How is EOS WASM virtual machine hardened?

WASM, famous from web browsers, regularly sees breaking out of sandbox issues. For example, see WebAssembly notes here: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-...