Questions tagged [security]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2 votes
0 answers
20 views

Access protected API from off-chain worker

Is it possible to access a protected API from an off-chain worker, e.g. using an API Key? Hard coding the API Key would be possible, but that's obviously a security risk. Is there a safe mechanism to ...
Ronin's user avatar
  • 175
1 vote
0 answers
26 views

Rate-limiting to prevent extrinsic spamming

Is there any rate-limiting defense system in Substrate, that would prevent an attacker with sufficient funds to spam extrinsics on a given parachain ? Is there any maximum amount of extrinsics per ...
clst's user avatar
  • 21
0 votes
0 answers
15 views

Is it secure enough use an Ed25519 expanded secret key which converted from a sr25519 key

I am developing a wallet using Rust and I want it to be compatible with polkadot-js import/export functionality. I know that polkadot-js uses the ed25519 extended mode for sr25519 private keys. So, I ...
Xu Neal's user avatar
1 vote
0 answers
30 views

How to implement multi-currency staking?

I was wondering what would be the best way to achieve multi-currency staking given: It's on a solo chain Foreign assets are bridged (like Eth or BTC, pallet-asset can be used) No conversion from ...
Leouarz's user avatar
  • 353
1 vote
0 answers
13 views

In Core vs On Chain Security

In this rfc: CoreJam Gav mentions workloads being done on-chain vs in-core. I was wondering what the security differences are between work done in these two spheres. Is there a difference? Thank you.
Dom's user avatar
  • 11
6 votes
2 answers
65 views

Efficiently limit NFT transfers to members of a group

What is/are the preferred approach/es (crates, pallets, etc.) to efficiently limiting NFT transfers to members of a group? Here efficiently refers to the resources consumed to execute the transfer. ...
Begley Brothers Inc's user avatar
1 vote
0 answers
19 views

How to fix dependabot security alert wasmtime vulnerable to guest-controlled out-of-bounds read/write on x86_64

I forked my parachain from substrate-node-template (polkadot-v0.9.29). Dependabot has generated following security alert: wasmtime vulnerable to guest-controlled out-of-bounds read/write on x86_64 ...
Syed Kamran's user avatar
1 vote
0 answers
29 views

How to update dependent packages to resolve dependabot security allert

I forked my parachain from substrate-node-template (polkadot-v0.9.29). There are several security alerts generated by github dependabot, I am sharing just one here for an example: Security Alert (As ...
Syed Kamran's user avatar
4 votes
1 answer
69 views

Why doesn't Substrate implement a CSPRNG (Cryptographically Secure Pseudorandom Number Generator)?

In the Rust documentation here it says that the hashing function that a Rust HashMap uses is SipHash. It says SipHash can provide resistance to DoS attacks involving hash tables, not that it will, ...
Luke Schoen's user avatar
  • 2,312
0 votes
0 answers
60 views

Using the --rpc-cors flag with anything besides 'all' gives rejected connection

I'm trying to use the --rpc-cors flag in a remote VM, behind a ssl enabled nginx proxy. When connecting using the Polkadot UI passing 'all' as parameter, it connects without problem in wss://...
Alexandre Ribeiro's user avatar
1 vote
1 answer
72 views

How to implement a production randomness pallet?

Hey valuable community member, I am currently on a randomness pallet which can be used as a production counterpart to the insecure randomness-collective-flip pallet. This is my current version: https:/...
Chralt's user avatar
  • 543
2 votes
1 answer
81 views

Should we re-do the verification in runtime call?

Imagine there is an unsigned extrinsic call. #[pallet::call] fn call(something, ..) -> DispatchResult { ensure_none()?; // verify(something)?; Ok(()) } #[pallet::validate_unsigned] ...
AurevoirXavier's user avatar
6 votes
1 answer
204 views

How to avoid impersonation when using DescendOrigin XCM

I'm using Transact to execute an extrinsic from one parachain to another. This extrinsic requires the origin to be a signed account which I'm verifying with ensure_signed. The way I'm getting a signed ...
Juan Ignacio Rios's user avatar
2 votes
1 answer
221 views

How to ensure parachain block validity without fishermen

In the Polkadot white paper and W3F research papers and lots of other articles, Fishermen is frequently described. This Fishermen (parachain full node) role checks validity of blocks by pointing out ...
Shunsuke's user avatar
  • 432
3 votes
1 answer
59 views

Is there a size limit on substrate messages?

So, substrate uses a bunch of network messages like block announce, grandpa message, block request-response, transaction. Substrate has notification substream open sending and receiving these messages ...
kishan sagathiya's user avatar
2 votes
1 answer
102 views

How are solo chain validators protected against DoS?

It's clear that we must include the IP addresses to our validators on our chainspec if we are starting a solo-chain (Correct me if I am wrong here, does it need to be a validator IP or can it be any ...
Purple_Turtle's user avatar
2 votes
1 answer
176 views

How to deploy a hardened, secure, production-ready Substrate node?

I'm currently looking for a way to deploy the blockchain I'm working on and it has been a struggle to find out the best practices for doing so. The chain is based on the substrate-node-template but it ...
edmassarani's user avatar
0 votes
1 answer
115 views

Different between safe and unsafe RPC calls

When running a substrate node, the CLI accepts a parameter called rpc_methods which accepts Auto, Safe and Unsafe arguments. How can developers declare an RPC call Unsafe and how can one get the list ...
Shabgard's user avatar
6 votes
1 answer
85 views

What factors determine who can peer with my node?

From a security standpoint I'd like to understand who can peer with my node. Let's say I make the chainspec public, and someone comes along with a different node binary, and peers with my node, with a ...
Purple_Turtle's user avatar
3 votes
1 answer
61 views

Is there any wargame-like for Substrate?

In my opinion, the best way to learn things is by practicing. The Substrate's tutorial (and docs) are already great on that matter. But I have to say that I miss something around security there. I ...
Artur Gontijo's user avatar