Skip to main content

Questions tagged [security]

For questions relating to the security of the blockchain, contracts and dApps.

Filter by
Sorted by
Tagged with
2 votes
2 answers
334 views

A possible alternative sign in/login process instead of firebase auth / amazon cognito using an eos contract?

I had the the idea of a secure alternative login process using an EOS smart contract instead of firebase or Amazon cognito. I would like to know if something like this feasible? My idea is somewhat ...
1 vote
1 answer
119 views

validate the identity of the chain

as a non-block producer, how do I know I'm uploading a transaction to the true eos blockchain and not an impersonator? What methods exist to verify that? Example: websites use certificates.
1 vote
2 answers
55 views

How to tell a certain contract in indeed used in a dApp?

The dapp review sites often list the contract names a dapp is using. I see that this is added by whoever has added that dApp into the review site. But is there a verifiable way (through an explorer ...
0 votes
1 answer
123 views

How can I remove or disable eosio development key and assign permission for another account as super users

Because it's for security reasons...It seem like disable Administrator on Windows Server. Please advise, Thank you.
0 votes
1 answer
26 views

How do you run nodeos as a non-root user?

I'm working on one node which is running on a testnet, and since I'm kinda new to this environment I'm wondering how can I drop privilege level to a non-root user for running a node on a server? Can I ...
0 votes
1 answer
36 views

Secure access to my private Blockchain

I have a private blockchain based on EOS. I would like to know, know how to secure all access to the EOS blockchain using an account. I'm talking about access to APIs that could give information or ...
1 vote
1 answer
84 views

Key derivation functions (KDF) with EOS private key

For our application we would like to derive hundreds of keys from an EOS private key without compromising the key. Is there any way to do this in EOS currently or any recommended external library to ...
5 votes
1 answer
91 views

How can you make sure you know what the contract does when you send an action?

Say you want to send an action to a smart contract, and you know the WASM of the contract. You somehow obtained the original source code which was in C++, you compiled it to WASM, and you got the same ...
14 votes
2 answers
415 views

How is EOS WASM virtual machine hardened?

WASM, famous from web browsers, regularly sees breaking out of sandbox issues. For example, see WebAssembly notes here: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-...
2 votes
1 answer
48 views

Can one provably disable user-initiated transfers from an account?

In this scenario a deployed smart contract should have and retain full control of the funds (excluding BPs of course) on the account. How can one stop transfers from an account by the account owner? ...
1 vote
0 answers
34 views

Hold funds for a time period with no possibility of contract's owner/author stealing them

if I write an EOS smart contract such that party A can send EOS to party B, but the contract will hold the funds for (say) 48 hours before releasing them to party B, can I do this in a way that would ...
7 votes
2 answers
419 views

Is there a flaw in deciding who can pay for RAM?

Lets say I interact with an action from a smart contract, if I'm not careful and didn't read or couldn't understand the source code for the smart contract, is it not possible that the contract could ...
4 votes
1 answer
401 views

How does EOS prevent one contract from accessing another contract's tables without authorization?

I noticed that multi-index (which is under eosio namespace) uses the following to prevent access to another contract's tables: eosio_assert( _code == current_receiver(), "cannot create objects in ...
5 votes
1 answer
62 views

What are the worst cases if I allow my contract to call an evil action of an evil contract?

I am considering to allow my contract to call the transfer action of a user specified contract. I would like to know what are the worst cases that can happen with this design. My contract code will ...
3 votes
1 answer
105 views

Can a plugin be configured to only process irreversible blocks?

We would like to implement a custom plugin within our own node, in order to listen to transactions from the main net, and then push relevant information to external services. However, we are ...
2 votes
0 answers
78 views

How to compile keosd with Secure Enclave support?

I've followed the steps outlined here https://github.com/EOSIO/eos/issues/4604 and gathered the required info. I'm trying this on a Mac with T2 chip. For Step 3, how should I modify the eosin_build....
4 votes
1 answer
292 views

What's the best way to prevent overflow/underflow attack?

In Solidity, people use a SafeMath library to prevent overflow/underflow attack. So, I wonder what's the best way to prevent overflow/underflow attack for EOS contract. Is there an easy-to-use ...
6 votes
1 answer
133 views

Is delegated Proof of Stake vulnerable to government censorship?

EOS uses delegated Proof of Stake, Dan's innovation used also in previous graphene blockchains such as Bitshares and Steem. I was reading commentary from a blockchain news and commentator, Bruce ...
4 votes
1 answer
132 views

360 Security Bug Claim. Truth or FUD?

Coingape reported that Internet Security Giant 360 found an Epic Secutiry Bug in EOS. According to the article, "remote attacks on its blockchain platform can directly control it and take over all ...