Questions tagged [security]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
21 views

Why to keep tezos-signer on a separate host?

I don't see any reason to do that. Say, if cloud service is hacked, then it's likely that both vms (with a node and signer) are hacked. Moreover, there're will be some networking, which is also ...
0
votes
1answer
9 views

What keys management setup is recommended to use with tezos-reward-distributor?

Currently for payouts I'm using a traditional tz1 addr, which is managed by the default tezos-signer binary. However, it appears to me not that safe. Some kind of HSM + KMS (say, from Google or from ...
0
votes
1answer
99 views

How to manage secret keys generate from the tezos-client?

The tezos-client allows users to generate a pair of public and secret keys in the command line: gen keys <new> [-f --force] [-s --sig <ed25519|secp256k1|p256>] ...
0
votes
1answer
67 views

Is Tezos blockchain vulnerable to "frontrunning"?

I read an interesting piece about frontrunning in Ethereum. In essense, the problem is this: In general, frontrunning is the act of getting a transaction first in line in the execution queue, right ...
1
vote
1answer
51 views

Design an oracle that provides random values to a contract

This answer mentions an improved way for an oracle to provide random numbers to a contract. use commitments, i.e. the oracle would push a hash in the contract before the game, and send the random ...
2
votes
1answer
70 views

Tezos baker port to open for mainnet for good security

Hello Tezos community, I read about Tezos public port to open for mainnet, and try to achieve a good security. I understand the default port to open is 9732. Is it a good practice to open this port ...
0
votes
0answers
49 views

Baking on VPS in cloud with ledger nano?

Hello Tezos community, I read the documentation on ledger setup on tezos doc and ledger obsidiansystems app. I understand now how to create a secure account on my laptop with ledger Nano, and delegate ...
1
vote
2answers
45 views

Is it possible to reverse engineer private key? [closed]

Is it possible to discover the private key for a public address given one possesses the public key and the encryption passphrase?
1
vote
1answer
65 views

eztz paper wallet

I'm totally new to Tezos but I'd like to have a paper wallet. Apparently eztz by Stephen Andrews offers this service but I'd like to know how it works. With BTC you have your private key, your ...
5
votes
1answer
212 views

What are the best cold-storage methods available for XTZ?

Is using the CLI command gen keys new to generate a cryptographically secure key-pair the most secure method for cold storage eg. paper wallet? Which signature algorithm (ed25519, secp256k1, p256) ...
2
votes
1answer
176 views

Why is bip25519 better than ed25519?

I read the article by Obsidian Systems and the linked post on recovery attack. I am not an expert, so I am asking to provide some details on why new accounts should use bip25519 derivation scheme and ...
1
vote
1answer
135 views

How to verify the manager.tz script code?

Since the protocol update to Babylon all KT1 accounts were replaced with smart contracts which contain the manager.tz script. Code: parameter (or (lambda %do unit (list operation)) (unit ...
0
votes
1answer
124 views

How to sign transaction from tz2 address?

Can i sign my transaction if i use secp256k1? And how it do? If i'm using sign function from eztz lib, i takes TypeError: invalid privateKey length Private key coded using secp256k1 curve.
1
vote
0answers
48 views

Can i create HD wallets?

Can I generate extended (master) public key and derive child keys from it? Can you show example how to create extended public key and then import this key for deriving childs.
4
votes
1answer
38 views

Is delegating insecure?

I'm new to Tezos. I don't understand this phrase: The rub for investors is that generally speaking, validators running proof-of-stake nodes (known as “bakers” on Tezos) must have some funds online ...
14
votes
2answers
641 views

How to make an offline transaction?

How do I create an offline transaction on an air-gapped device and broadcast it to the network?
14
votes
2answers
354 views

Formal verification of Tezos smart contracts

What are the analyses of Tezos smart contracts that could benefit dapps writers the most? Just to be clear, by “analysis” here I mean “static program analysis”. See for instance here. Basically the ...
8
votes
1answer
290 views

How to run tezos node in private mode using docker images?

I already have my node up and running using docker images with default configuration, so how can i change it to run in private node so that I can run few sentry nodes connected to public network and ...
-3
votes
1answer
81 views

How does the tezos blockchain security model works?

Suppose a baker has the highest staking balance, and has a few delegations from his own network and now when it comes to bake, he does something against the protocol or edits a transaction to profit ...
6
votes
1answer
273 views

Is a 51% attack possible in Tezos?

I was reading there was a recent 51% attack to Ethereum. Basically, hackers rented enough computer power to get 51% of the mining power, and insert false transactions into the blockchain. I wonder ...
7
votes
2answers
804 views

How do I know my password or backup information is not being shared when creating a new wallet?

Several services offer to create a new tezos wallet/account/key (tz1...). For example, consider Galleon Wallet. By entering a password, it produces a new wallet: You then need to choose a set of 12 ...
4
votes
2answers
111 views

Is a VPS with DDOS protection sufficient security for a Tezos bakery?

I was thinking about using Virmach $5.00 Windows server 2012 plan with the following specs: for example SSD1G 1GB DEDICATED RAM // 1 vCORE // 25GB+ SSD (HW RAID 10) // DDoS Protection Available // ...
10
votes
2answers
136 views

Where precisely lies the trust in a snapshot?

Nomadic Labs recently introduced the concept of snapshot as a way to speed-up the syncing of new tezos nodes. It is mentionned several times that there exists a certain minimal amount of trust that ...
11
votes
2answers
178 views

Reentrancy attack vector on tezos smart contracts?

I heard that Michelson helps with avoiding re-entrancy bug. Why is that? Is there some feature in the language that prevent it?
5
votes
1answer
58 views

Malicious third-party dependency vulnerability possible in Tezos?

Lately there was a compromised npm package, which was used as a dependency in various projects. The code allowed the attacker to steal funds if certain conditions were met. Could Tezos become a ...
3
votes
0answers
58 views

Interoperational Dangerous? [closed]

Can interoperational Chains like Cosmos be dangerous for the Tezos Network itself? Do such Chains "act" on our Tezos network? Or is it a complete own Space? Could such interoperational functions open ...