19 votes
Accepted

How to make an offline transaction?

Option 1 Kukai https://kukai.app/ Step 0 First make sure you have a secure offline environment for your wallet. You can either have a dedicated computer for it or a bootable Linux USB Flash Drive (...
user avatar
  • 2,638
17 votes
Accepted

Where precisely lies the trust in a snapshot?

Here is how the import works for you: you download a snapshot from a usb key found in a dark alley you start importing it, it displays the block hash it is importing you check in several places that ...
user avatar
  • 341
16 votes
Accepted

Reentrancy attack vector on tezos smart contracts?

Michelson (and higher level language like Liquidity on top of it) does not allow a smart contract to call another smart contract without commmitting its state/storage first. It makes reentrancy ...
user avatar
  • 3,278
14 votes

How to make an offline transaction?

All transactions included in the Tezos must reference a block hash within the past 60 block hashes. This acts as an additional layer of notarization of the chain, besides the consensus but it means ...
user avatar
  • 4,409
9 votes

Is a 51% attack possible in Tezos?

At the present time about 80% of the tezos tokens are actively used to bake/stake so the circulating supply you can buy on exchange is quite low. Therefore it would not even possible currently for an ...
user avatar
  • 6,006
8 votes

Formal verification of Tezos smart contracts

So this is a huge question and I think there are many people more qualified than me, but I'll offer some initial guidance. In Software Foundations, a book on Coq, they talk about an implied language ...
user avatar
  • 576
7 votes

Is a VPS with DDOS protection sufficient security for a Tezos bakery?

Short answer is no it is not. DDOS is actually a secondary security concern when baking. First and foremost you should be securing access to your baking server and your private keys. If someone gains ...
user avatar
  • 1,349
6 votes

How do I know my password or backup information is not being shared when creating a new wallet?

If the key is generated on their server, you have no way to know. If the key is generated locally in your browser, you may try to monitor the network to see what the wallet sends to the server. ...
user avatar
  • 3,278
6 votes
Accepted

Formal verification of Tezos smart contracts

If we agree that the purpose of analyses is to both prove properties and help users of smart contracts to understand them, I would say: Values: studying what values each element of the storage can ...
user avatar
  • 3,185
6 votes

How to run tezos node in private mode using docker images?

When you launch the docker node with ./mainnet.sh start, you can add extra arguments such as --private-mode --peer AAA.BBB.CCC.DDD:PORT (you probably need to specify --peer to connect your private ...
user avatar
  • 3,278
6 votes
Accepted

Malicious third-party dependency vulnerability possible in Tezos?

It's something to be careful about. If you look in scripts/version.sh you will see that the opam repository is pinned to a particular hash. This enforces Tezos being compiled against a specific ...
user avatar
  • 4,409
5 votes
Accepted

How to verify the manager.tz script code?

How to check the proof Currently, the only way to check the proof is to install and run the Coq proof assistant on the manager.tz file. This is automated in the continuous integration script of the ...
user avatar
5 votes

Where precisely lies the trust in a snapshot?

The trust relies in two elements: the hash of the last block in the snapshot (is it really on the official chain ?) the source code of your node (is it really doing what you think it does ?) For (1),...
user avatar
  • 3,278
5 votes
Accepted

What are the best cold-storage methods available for XTZ?

Hardware wallets like the Ledger Nano are good cold storage solutions. Offline-wallet creation in an air-gap device is also a good solution. Kukai wallet offers you the possibility to do offline-...
user avatar
  • 146
5 votes

How do I know my password or backup information is not being shared when creating a new wallet?

Any wallet software you choose to run comes with risks you should be fully aware of in order to properly protect yourself. Whether its a web, desktop, or mobile app you are running code that someone ...
user avatar
  • 1,979
4 votes
Accepted

How does the tezos blockchain security model works?

The delegators have nothing to do with the validity of the transactions signed by their delegate/baker. The delegated funds are never at risk and that is why it is always safe to delegate your tokens. ...
user avatar
  • 1,979
3 votes
Accepted

Is delegating insecure?

If you delegate this is not an issue for you. You can delegate to a baking service and then put your keys in cold storage (offline). You still control the funds. This is one of the real nice things ...
user avatar
  • 1,973
3 votes

Is a VPS with DDOS protection sufficient security for a Tezos bakery?

Highly recommend learning how to bake without bake chain. Running a bakery requires certain skills, like being able to work with the tezos client. If that is too daunting, then frankly, you do not ...
user avatar
  • 594
3 votes

Is Tezos blockchain vulnerable to "frontrunning"?

Choosing the order in which operations are applied is a privilege of the baker. So yes, frontrunning is possible on Tezos and can either be done by setting high fees (the default baker strategy is to ...
user avatar
2 votes
Accepted

eztz paper wallet

With regards to the difference between public key (pk), secret key (sk) and public key hash (pkh). The public key is used by other people to send encrypted messages to you, and it is also used by ...
user avatar
  • 2,348
2 votes
Accepted

Tezos baker port to open for mainnet for good security

Yes, open this port to the world. It allows others tezos nodes to discover and connect to you. Block all ports except 9732 Private mode simply tells other nodes that you do not accept incoming ...
user avatar
  • 3,364
1 vote
Accepted

How to encrypt a private key

This may answer your question: https://tezos.stackexchange.com/a/334/318 from pytezos.crypto import Key print(Key('edsk2juUM8ZMUkaCKHWVnzWhp9DxrK93YK1rQjYk3pTEq2ThXpBxkX').secret_key(passphrase="...
user avatar
1 vote
Accepted

Why to keep tezos-signer on a separate host?

You can have your ledger device plugged into machine A (at home/office/datacenter) running tezos-signer, connected over VPN to your baker machine B (in cloud). Using tezos-signer on a different ...
user avatar
  • 3,364
1 vote
Accepted

How to manage secret keys generate from the tezos-client?

If you want to move the keys, copy all the files inside ~/.tezos-client/ to the new machine. As you noticed, your secret key is encrypted, so even exposed by someone stealing your USB stick, they'd ...
user avatar
  • 3,364
1 vote

Design an oracle that provides random values to a contract

Some sketches of a response: You also need to trust that the oracle actually generates random values. Note that you can distribute the trust by using the several oracles and combining the result. I ...
user avatar
  • 2,348
1 vote

Is it possible to reverse engineer private key?

As @utdrmac mentioned, it is not possible to reverse engineer the private key from the public key. Public Key is created from a Private Key using one-way functions (also called trapdoor) which is easy ...
user avatar
  • 23
1 vote

Is it possible to reverse engineer private key?

No, it is not. Public keys are derived from the private key. Imagine if I had your public key (which is public information) and all I needed was your password to gain access to all of your funds. That ...
user avatar
  • 3,364
1 vote

Why is bip25519 better than ed25519?

Thanks for asking! See the answer I provided on this question - Kiln supporting bip32-ed25519 addreses. I'll copy it here for convenience: Tezos has adopted this new derivation scheme because it ...
user avatar
1 vote
Accepted

How to sign transaction from tz2 address?

You must sign transactions from tz2 addresses with secp256k1. Eztz's sign function uses Ed25519, so that wont work. Easiest would probably be to just replace libsodium in eztz with something like ...
user avatar
  • 1,320

Only top scored, non community-wiki answers of a minimum length are eligible