Questions tagged [security]
For questions relating to the security of the blockchain, contracts and dApps.
19 questions
14
votes
2
answers
415
views
How is EOS WASM virtual machine hardened?
WASM, famous from web browsers, regularly sees breaking out of sandbox issues. For example, see WebAssembly notes here:
https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-...
- 670
7
votes
2
answers
419
views
Is there a flaw in deciding who can pay for RAM?
Lets say I interact with an action from a smart contract, if I'm not careful and didn't read or couldn't understand the source code for the smart contract, is it not possible that the contract could ...
- 4,744
6
votes
1
answer
133
views
Is delegated Proof of Stake vulnerable to government censorship?
EOS uses delegated Proof of Stake, Dan's innovation used also in previous graphene blockchains such as Bitshares and Steem.
I was reading commentary from a blockchain news and commentator, Bruce ...
- 395
5
votes
1
answer
62
views
What are the worst cases if I allow my contract to call an evil action of an evil contract?
I am considering to allow my contract to call the transfer action of a user specified contract. I would like to know what are the worst cases that can happen with this design.
My contract code will ...
- 277
5
votes
1
answer
91
views
How can you make sure you know what the contract does when you send an action?
Say you want to send an action to a smart contract, and you know the WASM of the contract. You somehow obtained the original source code which was in C++, you compiled it to WASM, and you got the same ...
- 5,554
4
votes
1
answer
132
views
360 Security Bug Claim. Truth or FUD?
Coingape reported that Internet Security Giant 360 found an Epic Secutiry Bug in EOS.
According to the article, "remote attacks on its blockchain platform can directly control it and take over all ...
- 395
4
votes
1
answer
292
views
What's the best way to prevent overflow/underflow attack?
In Solidity, people use a SafeMath library to prevent overflow/underflow attack. So, I wonder what's the best way to prevent overflow/underflow attack for EOS contract. Is there an easy-to-use ...
- 277
4
votes
1
answer
401
views
How does EOS prevent one contract from accessing another contract's tables without authorization?
I noticed that multi-index (which is under eosio namespace) uses the following to prevent access to another contract's tables:
eosio_assert( _code == current_receiver(), "cannot create objects in ...
- 43
3
votes
1
answer
105
views
Can a plugin be configured to only process irreversible blocks?
We would like to implement a custom plugin within our own node, in order to listen to transactions from the main net, and then push relevant information to external services.
However, we are ...
- 231
2
votes
1
answer
48
views
Can one provably disable user-initiated transfers from an account?
In this scenario a deployed smart contract should have and retain full control of the funds (excluding BPs of course) on the account. How can one stop transfers from an account by the account owner?
...
- 267
2
votes
2
answers
334
views
A possible alternative sign in/login process instead of firebase auth / amazon cognito using an eos contract?
I had the the idea of a secure alternative login process using an EOS smart contract instead of firebase or Amazon cognito. I would like to know if something like this feasible?
My idea is somewhat ...
- 341
2
votes
0
answers
78
views
How to compile keosd with Secure Enclave support?
I've followed the steps outlined here https://github.com/EOSIO/eos/issues/4604 and gathered the required info. I'm trying this on a Mac with T2 chip.
For Step 3, how should I modify the eosin_build....
- 115
1
vote
1
answer
84
views
Key derivation functions (KDF) with EOS private key
For our application we would like to derive hundreds of keys from an EOS private key without compromising the key. Is there any way to do this in EOS currently or any recommended external library to ...
- 213
1
vote
2
answers
55
views
How to tell a certain contract in indeed used in a dApp?
The dapp review sites often list the contract names a dapp is using. I see that this is added by whoever has added that dApp into the review site.
But is there a verifiable way (through an explorer ...
- 121
1
vote
1
answer
119
views
validate the identity of the chain
as a non-block producer, how do I know I'm uploading a transaction to the true eos blockchain and not an impersonator? What methods exist to verify that? Example: websites use certificates.
- 21
1
vote
0
answers
34
views
Hold funds for a time period with no possibility of contract's owner/author stealing them
if I write an EOS smart contract such that party A can send EOS to party B, but the contract will hold the funds for (say) 48 hours before releasing them to party B, can I do this in a way that would ...
- 111
0
votes
1
answer
26
views
How do you run nodeos as a non-root user?
I'm working on one node which is running on a testnet, and since I'm kinda new to this environment I'm wondering how can I drop privilege level to a non-root user for running a node on a server?
Can I ...
- 101
0
votes
1
answer
36
views
Secure access to my private Blockchain
I have a private blockchain based on EOS. I would like to know, know how to secure all access to the EOS blockchain using an account. I'm talking about access to APIs that could give information or ...
- 53
0
votes
1
answer
123
views
How can I remove or disable eosio development key and assign permission for another account as super users
Because it's for security reasons...It seem like disable Administrator on Windows Server. Please advise, Thank you.
