Questions tagged [security]
The security tag has no usage guidance.
33
questions
1
vote
0
answers
22
views
What's the benefit of headers-first sync in Cardano?
Looking at the source code, it seems that Cardano used to not have headers-first sync, but later, it started doing headers-first sync. In bitcoin, there's a benefit in headers-first sync because block ...
0
votes
1
answer
46
views
Opportunity for theft of funds in Martify marketplace
I am some kinda embarrassed by "mkBuyValidator" in Martify Marketplace on-chain code . For buyer there is only one check for token transfer (on line 68):
(valueOf (valuePaidTo info sig) (...
0
votes
1
answer
61
views
Confusion about the time until true immutability
The security parameter k is set to 2160 blocks. The code comment describing this genesis parameter makes it crystal clear it defines the maximum number of blocks the chain could potentially roll back. ...
- 619
1
vote
1
answer
84
views
Cardano-cli requires signing key to be a file, fails with a named pipe
Please see the discussion here. https://forum.cardano.org/t/cardano-cli-signing-a-transaction-without-directly-accessing-the-skey-file-in-plain-text/103742/11
cardano-cli should be able to read ...
3
votes
1
answer
51
views
What is the best (and most secure) way to store private keys in an Express server?
I'm working on a server that will have access to a specific wallet that hold funds and NFTs to submit transactions. Therefore, it will have to manage private keys.
I'm thinking of storing them ...
- 1,055
0
votes
1
answer
266
views
How Do I Deploy a Wallet Connector to the Website in a Safe Way
If I want to start making a program that connects to the user's web wallet, such as nami in the google chrome browser, how do I ensure the security of the connection?
Using Nami and Google Chrome are ...
- 972
2
votes
1
answer
87
views
How expressive & secure is the Plutarch eDSL?
The Plutarch eDSL tries to control how plutus core is generated to create a smaller and thus a more efficient validator script (their GitHub).
I am not an in depth user of this tool. Does its approach ...
- 1,862
0
votes
1
answer
74
views
Cardano dapp user authentication based on the wallet address
What are the best options to add user-authentication system based on the wallet address for my website? Thanks
- 23
0
votes
2
answers
276
views
Is there a way to know if your wallet was restored (accessed) without a transaction being made?
In most cases, I would assume that if your wallet is compromised, your funds are going to be stolen and that is how you are going to know it is compromised. However, let's assume a hypothetical threat ...
1
vote
3
answers
129
views
What Utility Do Third-Party Services Provide with Undisclosed Slot Lottery Information?
Small Sample of Concerns Belonging to Larger Family of Unknown Real or Figurative Concerns
I would like to send my predetermined Slot Leader reports to PoolTool, yet I only use the API key they ...
- 345
1
vote
3
answers
93
views
What are some ways a SPO can attack the network and what mechanisms exist to discourage or mitigate such attacks?
What are some ways a SPO can attack the Cardano blockchain? E.g. in Bitcoin, a miner could intentionally exclude certain transactions to the extend that the miner's hash power allows. Is something ...
- 1,335
3
votes
1
answer
56
views
Can you run a stake pool pseudonymously?
To be a stake pool operator and run a stake pool, can you do this pseudonymously? If so, What are the pro/cons to this?
Would this be preferred to prevent hacks, enhance DevSecOp, and potentially ...
- 400
2
votes
0
answers
38
views
Design considerations when automatically signing and submitting Cardano transactions
Automating transactions (eg an Oracle that regularly publishes meta data to the blockchain) require that we balance the necessity to sign each transaction using a signing key with the security of the ...
- 141
6
votes
2
answers
368
views
Can I avoid using a public IP on Block-Producer (BP) node?
My BP and relays are on the same local subnet, I would prefer to give them the private IP address in the topology files.
However, all of the guides I've come across explicitly state using public IPs. ...
- 345
1
vote
1
answer
37
views
is it possible to execute an undecidable off-chain loop, and attack the network in this way?
is it possible to execute an undecidable off-chain loop, and attack the network in this way? taking into account that the off-chain code is flat Haskell code is also complete turing.
0
votes
2
answers
143
views
Can I Share Daedalus Public Key?
I am trying to add my accounts to a coin baalance tracker, but am having a hard time with Daedalus.
The only option that seems to make any sense is sharing the public key with the tracker apps. Is ...
- 345
5
votes
1
answer
223
views
What security exists in Daedalus for protecting the private key
If the wallet private key is in \AppData\Roaming\Daedalus\Secrets-1.0 what security exists from physical access to this file?
Per this https://forum.cardano.org/t/where-are-the-public-and-private-keys-...
4
votes
1
answer
122
views
Canonical example of Smart Contract Verification?
Given that the chief benefit of Cardano Smart Contracts over Ethereum Smart Contracts is formal verification (and thus its implied validity, security, and robustness), is there a non-trivial example ...
- 301
4
votes
4
answers
156
views
Spare computer with Yoroi or Daedalus as pseudo cold wallet v. Ledger
Am running through my mind the pros and cons of storing Ada on a spare computer disconnected from the network, not happy with being connected to the Internet 24/7 despite being behind firewall.
Apart ...
- 41
3
votes
1
answer
122
views
Unable to view images from ipfs.blockfrost.dev
I am unable to view images on ipfs.blockfrost.dev on my Mac. However, I can view them on my iPhone. I have tried Brave, Chrome, and Safari browsers.
Here is the error message I get when I click '...
- 131
1
vote
2
answers
74
views
Official Cardona Telegram Channel? [closed]
Is this an official Cardano Telegram channel?
https://t.me/Cardonacommunitychat
- 31
2
votes
2
answers
89
views
hardware wallet
With all the hacking of personal computers, ledger, and t-mobile; what is the safest way to store ADA? I have been hacked through ledger live through a google add-on. Is Yori with ledger safe?
thanks,
...
- 21
4
votes
1
answer
76
views
Airgapping Concerns for Block Producer Secrets
I am trying to understand the extreme caution about creating secrets for the BP node.
Is the concern about not knowing what one might lease in the cloud, or how security is in such a company, or their ...
- 345
9
votes
3
answers
568
views
What prevents flash loans attacks from occurring on the Cardano network?
Flash loans attacks are current in DeFi space and we saw several ones these last weeks on the Binance smart chain. (Pancake Bunny and Burger swaps)
Mr. Hoskinson said numerous times that if it took ...
- 91
5
votes
2
answers
834
views
Signs for the trustworthiness of the SundaeSwap project? [closed]
I would like to know, what are known signs about the trustworthiness of the project SudaeSwap?
What could be technically achievable black swan scenarios?
Is it a project that is connected with Cardano?...
- 67
12
votes
1
answer
66
views
What decisions are left to the slot leader?
Is the order of transactions deterministic, or is it decided by the slot leader when creating the block? Are DEX front-running attacks a possibility?
Can the slot leader censor specific transactions ...
- 221
16
votes
3
answers
205
views
Are there safeguards preventing big centralised exchanges like Binance and Kraken from having too much power in projects like Catalyst?
Kraken recently announced it would let its users stake Ada on their account.
However, since Kraken owns this ADA, I understand this means it could have the voting power of all its users combined on ...
- 443
9
votes
2
answers
297
views
How would a 51% Attack on the Cardano blockchain be started and overcome?
What exactly is the 51% Attack?
How hard would it be to accomplish this attack?
How easy is it to overcome the attack should it actually occur?
- 211
7
votes
2
answers
621
views
Can two-factor authentication (2FA) be added to the Daedalus and Yoroi wallets?
I would like to ask if it is possible to implement 2FA at the wallets of cardano for increased security. As I see it we like to attract people from developing world they don't have access to hardware ...
5
votes
2
answers
2k
views
Is Yoroi secure as a primary wallet?
I received an IOHK support ticket response this week that recommended I install the Yoroi wallet:
The Daedalus wallet is a full-node wallet, so it can take time to
install and can be difficult to use ...
- 269
0
votes
1
answer
45
views
Staying secure for every day users: What recommendations do security experts have for wallet management, safety, maintenance? [closed]
What's the safest way to store BIP39 seed words?
What hardware wallet backup options exist?
How can I share details on wallet maintenance with family?
- 629
3
votes
3
answers
166
views
How much entropy does BIP39 have?
How much entropy does BIP39 have?
How long would brute forcing take?
Can a 2nd factor be included on a wallet, to lock, unlock it?
- 629
11
votes
3
answers
279
views
What are the security risks of storing an encrypted wallet seed in a password manager?
We've all seen the recommendation against storing our wallet seed phrases digitally. And while I understand the sentiment and reasoning, in reality, for many it could be even less secure to store a ...
- 269