19
votes
Accepted
How to make an offline transaction?
Option 1 Kukai
https://kukai.app/
Step 0
First make sure you have a secure offline environment for your wallet. You can either have a dedicated computer for it or a bootable Linux USB Flash Drive (...
- 2,635
17
votes
Accepted
Where precisely lies the trust in a snapshot?
Here is how the import works for you:
you download a snapshot from a usb key found in a dark alley
you start importing it, it displays the block hash it is importing
you check in several places that ...
- 341
16
votes
Accepted
Reentrancy attack vector on tezos smart contracts?
Michelson (and higher level language like Liquidity on top of it) does not allow a smart contract to call another smart contract without commmitting its state/storage first. It makes reentrancy ...
- 3,308
14
votes
How to make an offline transaction?
All transactions included in the Tezos must reference a block hash within the past 60 block hashes. This acts as an additional layer of notarization of the chain, besides the consensus but it means ...
- 4,599
9
votes
Is a 51% attack possible in Tezos?
At the present time about 80% of the tezos tokens are actively used to bake/stake so the circulating supply you can buy on exchange is quite low.
Therefore it would not even possible currently for an ...
- 6,064
8
votes
Formal verification of Tezos smart contracts
So this is a huge question and I think there are many people more qualified than me, but I'll offer some initial guidance.
In Software Foundations, a book on Coq, they talk about an implied language ...
- 576
7
votes
Is a VPS with DDOS protection sufficient security for a Tezos bakery?
Short answer is no it is not.
DDOS is actually a secondary security concern when baking. First and foremost you should be securing access to your baking server and your private keys. If someone gains ...
- 1,379
6
votes
How do I know my password or backup information is not being shared when creating a new wallet?
If the key is generated on their server, you have no way to know.
If the key is generated locally in your browser, you may try to monitor the network to see what the wallet sends to the server. ...
- 3,308
6
votes
Accepted
Formal verification of Tezos smart contracts
If we agree that the purpose of analyses is to both prove properties and help users of smart contracts to understand them, I would say:
Values: studying what values each element of the storage can ...
- 3,260
6
votes
How to run tezos node in private mode using docker images?
When you launch the docker node with ./mainnet.sh start, you can add extra arguments such as --private-mode --peer AAA.BBB.CCC.DDD:PORT (you probably need to specify --peer to connect your private ...
- 3,308
6
votes
Accepted
Malicious third-party dependency vulnerability possible in Tezos?
It's something to be careful about. If you look in scripts/version.sh you will see that the opam repository is pinned to a particular hash. This enforces Tezos being compiled against a specific ...
- 4,599
5
votes
Accepted
How to verify the manager.tz script code?
How to check the proof
Currently, the only way to check the proof is to install and run the Coq proof assistant on the manager.tz file. This is automated in the continuous integration script of the ...
- 2,703
5
votes
Where precisely lies the trust in a snapshot?
The trust relies in two elements:
the hash of the last block in the snapshot (is it really on the official chain ?)
the source code of your node (is it really doing what you think it does ?)
For (1),...
- 3,308
5
votes
Accepted
What are the best cold-storage methods available for XTZ?
Hardware wallets like the Ledger Nano are good cold storage solutions.
Offline-wallet creation in an air-gap device is also a good solution.
Kukai wallet offers you the possibility to do offline-...
- 146
5
votes
How do I know my password or backup information is not being shared when creating a new wallet?
Any wallet software you choose to run comes with risks you should be fully aware of in order to properly protect yourself.
Whether its a web, desktop, or mobile app you are running code that someone ...
- 1,999
4
votes
Accepted
How does the tezos blockchain security model works?
The delegators have nothing to do with the validity of the transactions signed by their delegate/baker. The delegated funds are never at risk and that is why it is always safe to delegate your tokens.
...
- 1,999
3
votes
Accepted
Is delegating insecure?
If you delegate this is not an issue for you. You can delegate to a baking service and then put your keys in cold storage (offline). You still control the funds. This is one of the real nice things ...
- 1,973
3
votes
Is a VPS with DDOS protection sufficient security for a Tezos bakery?
Highly recommend learning how to bake without bake chain. Running a bakery requires certain skills, like being able to work with the tezos client. If that is too daunting, then frankly, you do not ...
- 604
3
votes
Is Tezos blockchain vulnerable to "frontrunning"?
Choosing the order in which operations are applied is a privilege of the baker. So yes, frontrunning is possible on Tezos and can either be done by setting high fees (the default baker strategy is to ...
- 2,703
2
votes
Accepted
eztz paper wallet
With regards to the difference between public key (pk), secret key (sk) and public key hash (pkh).
The public key is used by other people to send encrypted messages to you, and it is also used by ...
- 2,378
2
votes
Why is bip25519 better than ed25519?
Thanks for asking! See the answer I provided on this question - Kiln supporting bip32-ed25519 addreses. I'll copy it here for convenience:
Tezos has adopted this new derivation scheme because it ...
- 669
2
votes
Accepted
Tezos baker port to open for mainnet for good security
Yes, open this port to the world. It allows others tezos nodes to discover and connect to you.
Block all ports except 9732
Private mode simply tells other nodes that you do not accept incoming ...
- 3,422
1
vote
Accepted
How to encrypt a private key
This may answer your question: https://tezos.stackexchange.com/a/334/318
from pytezos.crypto import Key
print(Key('edsk2juUM8ZMUkaCKHWVnzWhp9DxrK93YK1rQjYk3pTEq2ThXpBxkX').secret_key(passphrase="...
- 3,923
1
vote
Accepted
Why to keep tezos-signer on a separate host?
You can have your ledger device plugged into machine A (at home/office/datacenter) running tezos-signer, connected over VPN to your baker machine B (in cloud). Using tezos-signer on a different ...
- 3,422
1
vote
Accepted
How to manage secret keys generate from the tezos-client?
If you want to move the keys, copy all the files inside ~/.tezos-client/ to the new machine. As you noticed, your secret key is encrypted, so even exposed by someone stealing your USB stick, they'd ...
- 3,422
1
vote
Design an oracle that provides random values to a contract
Some sketches of a response:
You also need to trust that the oracle actually generates random values. Note that you can distribute the trust by using the several oracles and combining the result.
I ...
- 2,378
1
vote
Is it possible to reverse engineer private key?
As @utdrmac mentioned, it is not possible to reverse engineer the private key from the public key. Public Key is created from a Private Key using one-way functions (also called trapdoor) which is easy ...
- 23
1
vote
Is it possible to reverse engineer private key?
No, it is not. Public keys are derived from the private key. Imagine if I had your public key (which is public information) and all I needed was your password to gain access to all of your funds. That ...
- 3,422
1
vote
Accepted
How to sign transaction from tz2 address?
You must sign transactions from tz2 addresses with secp256k1. Eztz's sign function uses Ed25519, so that wont work. Easiest would probably be to just replace libsodium in eztz with something like ...
- 1,345
Only top scored, non community-wiki answers of a minimum length are eligible