Skip to main content

Questions tagged [security]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer
24 views

What number of confirmations is considered secure in Cardano?

There is k finalization param in Ouroboros, but it is absolutely non-practical. It takes around 36 hours AFAIU.
uhbif19's user avatar
  • 121
1 vote
0 answers
23 views

What's the benefit of headers-first sync in Cardano?

Looking at the source code, it seems that Cardano used to not have headers-first sync, but later, it started doing headers-first sync. In bitcoin, there's a benefit in headers-first sync because block ...
The Quantum Physicist's user avatar
0 votes
1 answer
48 views

Opportunity for theft of funds in Martify marketplace

I am some kinda embarrassed by "mkBuyValidator" in Martify Marketplace on-chain code . For buyer there is only one check for token transfer (on line 68): (valueOf (valuePaidTo info sig) (...
Anastasia Martyniuk's user avatar
0 votes
1 answer
85 views

Confusion about the time until true immutability

The security parameter k is set to 2160 blocks. The code comment describing this genesis parameter makes it crystal clear it defines the maximum number of blocks the chain could potentially roll back. ...
LACE pool's user avatar
  • 619
1 vote
1 answer
87 views

Cardano-cli requires signing key to be a file, fails with a named pipe

Please see the discussion here. https://forum.cardano.org/t/cardano-cli-signing-a-transaction-without-directly-accessing-the-skey-file-in-plain-text/103742/11 cardano-cli should be able to read ...
Alfred Vilsmeier's user avatar
3 votes
1 answer
53 views

What is the best (and most secure) way to store private keys in an Express server?

I'm working on a server that will have access to a specific wallet that hold funds and NFTs to submit transactions. Therefore, it will have to manage private keys. I'm thinking of storing them ...
Falcon Stakepool's user avatar
0 votes
1 answer
311 views

How Do I Deploy a Wallet Connector to the Website in a Safe Way

If I want to start making a program that connects to the user's web wallet, such as nami in the google chrome browser, how do I ensure the security of the connection? Using Nami and Google Chrome are ...
KryptoKing's user avatar
2 votes
1 answer
89 views

How expressive & secure is the Plutarch eDSL?

The Plutarch eDSL tries to control how plutus core is generated to create a smaller and thus a more efficient validator script (their GitHub). I am not an in depth user of this tool. Does its approach ...
Fermat's user avatar
  • 1,892
0 votes
1 answer
78 views

Cardano dapp user authentication based on the wallet address

What are the best options to add user-authentication system based on the wallet address for my website? Thanks
Tahzeeb's user avatar
  • 23
0 votes
2 answers
280 views

Is there a way to know if your wallet was restored (accessed) without a transaction being made?

In most cases, I would assume that if your wallet is compromised, your funds are going to be stolen and that is how you are going to know it is compromised. However, let's assume a hypothetical threat ...
Jacob - SNOWY Pool's user avatar
1 vote
3 answers
129 views

What Utility Do Third-Party Services Provide with Undisclosed Slot Lottery Information?

Small Sample of Concerns Belonging to Larger Family of Unknown Real or Figurative Concerns I would like to send my predetermined Slot Leader reports to PoolTool, yet I only use the API key they ...
Louis Waweru's user avatar
1 vote
3 answers
93 views

What are some ways a SPO can attack the network and what mechanisms exist to discourage or mitigate such attacks?

What are some ways a SPO can attack the Cardano blockchain? E.g. in Bitcoin, a miner could intentionally exclude certain transactions to the extend that the miner's hash power allows. Is something ...
Joshua Chia's user avatar
  • 1,335
3 votes
1 answer
57 views

Can you run a stake pool pseudonymously?

To be a stake pool operator and run a stake pool, can you do this pseudonymously? If so, What are the pro/cons to this? Would this be preferred to prevent hacks, enhance DevSecOp, and potentially ...
TheStophe's user avatar
  • 400
2 votes
0 answers
38 views

Design considerations when automatically signing and submitting Cardano transactions

Automating transactions (eg an Oracle that regularly publishes meta data to the blockchain) require that we balance the necessity to sign each transaction using a signing key with the security of the ...
spirois's user avatar
  • 141
6 votes
2 answers
376 views

Can I avoid using a public IP on Block-Producer (BP) node?

My BP and relays are on the same local subnet, I would prefer to give them the private IP address in the topology files. However, all of the guides I've come across explicitly state using public IPs. ...
Louis Waweru's user avatar
1 vote
1 answer
38 views

is it possible to execute an undecidable off-chain loop, and attack the network in this way?

is it possible to execute an undecidable off-chain loop, and attack the network in this way? taking into account that the off-chain code is flat Haskell code is also complete turing.
HaskellRustian's user avatar
0 votes
2 answers
161 views

Can I Share Daedalus Public Key?

I am trying to add my accounts to a coin baalance tracker, but am having a hard time with Daedalus. The only option that seems to make any sense is sharing the public key with the tracker apps. Is ...
Louis Waweru's user avatar
5 votes
1 answer
240 views

What security exists in Daedalus for protecting the private key

If the wallet private key is in \AppData\Roaming\Daedalus\Secrets-1.0 what security exists from physical access to this file? Per this https://forum.cardano.org/t/where-are-the-public-and-private-keys-...
011000010110111001101111011011's user avatar
4 votes
1 answer
125 views

Canonical example of Smart Contract Verification?

Given that the chief benefit of Cardano Smart Contracts over Ethereum Smart Contracts is formal verification (and thus its implied validity, security, and robustness), is there a non-trivial example ...
Michael Daconta's user avatar
4 votes
4 answers
169 views

Spare computer with Yoroi or Daedalus as pseudo cold wallet v. Ledger

Am running through my mind the pros and cons of storing Ada on a spare computer disconnected from the network, not happy with being connected to the Internet 24/7 despite being behind firewall. Apart ...
chaz1234's user avatar
3 votes
1 answer
123 views

Unable to view images from ipfs.blockfrost.dev

I am unable to view images on ipfs.blockfrost.dev on my Mac. However, I can view them on my iPhone. I have tried Brave, Chrome, and Safari browsers. Here is the error message I get when I click '...
Will Cousin's user avatar
1 vote
2 answers
84 views

Official Cardona Telegram Channel? [closed]

Is this an official Cardano Telegram channel? https://t.me/Cardonacommunitychat
AshK's user avatar
  • 31
2 votes
2 answers
90 views

hardware wallet

With all the hacking of personal computers, ledger, and t-mobile; what is the safest way to store ADA? I have been hacked through ledger live through a google add-on. Is Yori with ledger safe? thanks, ...
Jon Williams's user avatar
4 votes
1 answer
76 views

Airgapping Concerns for Block Producer Secrets

I am trying to understand the extreme caution about creating secrets for the BP node. Is the concern about not knowing what one might lease in the cloud, or how security is in such a company, or their ...
Louis Waweru's user avatar
10 votes
3 answers
581 views

What prevents flash loans attacks from occurring on the Cardano network?

Flash loans attacks are current in DeFi space and we saw several ones these last weeks on the Binance smart chain. (Pancake Bunny and Burger swaps) Mr. Hoskinson said numerous times that if it took ...
CryptoChau's user avatar
5 votes
2 answers
834 views

Signs for the trustworthiness of the SundaeSwap project? [closed]

I would like to know, what are known signs about the trustworthiness of the project SudaeSwap? What could be technically achievable black swan scenarios? Is it a project that is connected with Cardano?...
Oriol's user avatar
  • 67
12 votes
1 answer
70 views

What decisions are left to the slot leader?

Is the order of transactions deterministic, or is it decided by the slot leader when creating the block? Are DEX front-running attacks a possibility? Can the slot leader censor specific transactions ...
Daniel Hawkins's user avatar
16 votes
3 answers
206 views

Are there safeguards preventing big centralised exchanges like Binance and Kraken from having too much power in projects like Catalyst?

Kraken recently announced it would let its users stake Ada on their account. However, since Kraken owns this ADA, I understand this means it could have the voting power of all its users combined on ...
LaX's user avatar
  • 443
9 votes
2 answers
310 views

How would a 51% Attack on the Cardano blockchain be started and overcome?

What exactly is the 51% Attack? How hard would it be to accomplish this attack? How easy is it to overcome the attack should it actually occur?
Chad Carter's user avatar
7 votes
2 answers
638 views

Can two-factor authentication (2FA) be added to the Daedalus and Yoroi wallets?

I would like to ask if it is possible to implement 2FA at the wallets of cardano for increased security. As I see it we like to attract people from developing world they don't have access to hardware ...
Nottheonetoday's user avatar
5 votes
2 answers
2k views

Is Yoroi secure as a primary wallet?

I received an IOHK support ticket response this week that recommended I install the Yoroi wallet: The Daedalus wallet is a full-node wallet, so it can take time to install and can be difficult to use ...
a-fro's user avatar
  • 269
1 vote
1 answer
45 views

Staying secure for every day users: What recommendations do security experts have for wallet management, safety, maintenance? [closed]

What's the safest way to store BIP39 seed words? What hardware wallet backup options exist? How can I share details on wallet maintenance with family?
DaedelusDaemon's user avatar
3 votes
3 answers
178 views

How much entropy does BIP39 have?

How much entropy does BIP39 have? How long would brute forcing take? Can a 2nd factor be included on a wallet, to lock, unlock it?
DaedelusDaemon's user avatar
11 votes
3 answers
291 views

What are the security risks of storing an encrypted wallet seed in a password manager?

We've all seen the recommendation against storing our wallet seed phrases digitally. And while I understand the sentiment and reasoning, in reality, for many it could be even less secure to store a ...
a-fro's user avatar
  • 269