6
votes
Accepted
Is there a flaw in deciding who can pay for RAM?
Yes, I believe that your understanding is correct, as confirmed in a discussion on Telegram Developers Channel pasted below--Todd Fleming is a contributor to EOSIO codebase:
16th of August
User: ...
- 5,554
4
votes
What are the worst cases if I allow my contract to call an evil action of an evil contract?
Signatures are not just a list which can be copied and pasted, they're a key which is generated from the transaction. if the transaction changes, the signature is invalidated and will need resigning.
...
3
votes
Accepted
Is delegated Proof of Stake vulnerable to government censorship?
The short answer is Yes it is vulnerable to government censorship but not because it is dPOS. Dan Larimer has argued that having 21 Block Producers is enough for decentralization and this number can ...
- 303
3
votes
Accepted
360 Security Bug Claim. Truth or FUD?
Apparently the media report missed several details.
Block.One apparently issued a bug finding bounty, in an attempt to remove as many security holes as possible before launch. 360 apparently ...
- 395
3
votes
How is EOS WASM virtual machine hardened?
The Web Assembly Website has information on the potential security issues for both users and developers when coding in WASM.
With regards to arbitrary code execution in EOS, @confused00 points out ...
- 4,744
2
votes
Is there a flaw in deciding who can pay for RAM?
A stop-gap fix has been issued in v1.2.3 of EOS
Deprecation of the ability of a notified contract to bill RAM to authorizers of the original action
EOSIO blockchains enable a useful feature which ...
- 4,744
1
vote
How do you run nodeos as a non-root user?
Sure. nodeos itself does not require any special permissions that comes with root unless you want it to listen on a privileged port.
- 604
1
vote
Secure access to my private Blockchain
This can be done by putting proxy ahead of nodeos or using firewall. Nodeos doesn't have options for doing this.
- 2,320
1
vote
Accepted
Can one provably disable user-initiated transfers from an account?
If the contract owner wants to give up rights to update the contract or make transfers, they can change the contract owner and active permissions to eosio using cleos set account permission:
$ cleos ...
- 5,554
1
vote
How can you make sure you know what the contract does when you send an action?
You can do an SHA256 of the .wasm code to see its hash, and you can verify that on chain by doing cleos get code ACCOUNT_NAME. So it wouldn't be very difficult to write a script to check that the hash ...
- 4,744
1
vote
Key derivation functions (KDF) with EOS private key
What do you mean by deriving keys? Are you using the key to seed the randomness generator for other keys?
If that's the case and you're also trying to create EOS owner account keys with this method, ...
- 3,425
1
vote
What's the best way to prevent overflow/underflow attack?
EOS uses C ++, and C ++ assert can be used to check for overflow or underflow.
ex) assert( quantity + a.quantity >= a.quantity,"integer overflow adding token balance" );
See the link below for this.
...
- 1,015
1
vote
Can a plugin be configured to only process irreversible blocks?
there's a write-up on how exchanges should deal with deposits and withdrawals on the eos blockchain. It deals with irreversible blocks, might be useful:
https://developers.eos.io/eosio-cpp/docs/...
- 21
Only top scored, non community-wiki answers of a minimum length are eligible