Questions tagged [security]
The security tag has no usage guidance.
16
questions
1
vote
0
answers
8
views
In Core vs On Chain Security
In this rfc: CoreJam Gav mentions workloads being done on-chain vs in-core. I was wondering what the security differences are between work done in these two spheres. Is there a difference? Thank you.
- 11
6
votes
2
answers
60
views
Efficiently limit NFT transfers to members of a group
What is/are the preferred approach/es (crates, pallets, etc.) to efficiently limiting NFT transfers to members of a group?
Here efficiently refers to the resources consumed to execute the transfer.
...
1
vote
0
answers
17
views
How to fix dependabot security alert wasmtime vulnerable to guest-controlled out-of-bounds read/write on x86_64
I forked my parachain from substrate-node-template (polkadot-v0.9.29).
Dependabot has generated following security alert:
wasmtime vulnerable to guest-controlled out-of-bounds read/write on x86_64
...
- 651
1
vote
0
answers
25
views
How to update dependent packages to resolve dependabot security allert
I forked my parachain from substrate-node-template (polkadot-v0.9.29).
There are several security alerts generated by github dependabot, I am sharing just one here for an example:
Security Alert (As ...
- 651
3
votes
1
answer
59
views
Why doesn't Substrate implement a CSPRNG (Cryptographically Secure Pseudorandom Number Generator)?
In the Rust documentation here it says that the hashing function that a Rust HashMap uses is SipHash. It says SipHash can provide resistance to DoS attacks involving hash tables, not that it will, ...
- 2,262
0
votes
0
answers
41
views
Using the --rpc-cors flag with anything besides 'all' gives rejected connection
I'm trying to use the --rpc-cors flag in a remote VM, behind a ssl enabled nginx proxy. When connecting using the Polkadot UI passing 'all' as parameter, it connects without problem in wss://...
1
vote
1
answer
51
views
How to implement a production randomness pallet?
Hey valuable community member,
I am currently on a randomness pallet which can be used as a production counterpart to the insecure randomness-collective-flip pallet.
This is my current version:
https:/...
- 483
2
votes
1
answer
76
views
Should we re-do the verification in runtime call?
Imagine there is an unsigned extrinsic call.
#[pallet::call]
fn call(something, ..) -> DispatchResult {
ensure_none()?;
// verify(something)?;
Ok(())
}
#[pallet::validate_unsigned]
...
- 8,798
6
votes
1
answer
194
views
How to avoid impersonation when using DescendOrigin XCM
I'm using Transact to execute an extrinsic from one parachain to another. This extrinsic requires the origin to be a signed account which I'm verifying with ensure_signed.
The way I'm getting a signed ...
2
votes
1
answer
207
views
How to ensure parachain block validity without fishermen
In the Polkadot white paper and W3F research papers and lots of other articles, Fishermen is frequently described. This Fishermen (parachain full node) role checks validity of blocks by pointing out ...
- 432
3
votes
1
answer
52
views
Is there a size limit on substrate messages?
So, substrate uses a bunch of network messages like block announce, grandpa message, block request-response, transaction. Substrate has notification substream open sending and receiving these messages ...
2
votes
1
answer
97
views
How are solo chain validators protected against DoS?
It's clear that we must include the IP addresses to our validators on our chainspec if we are starting a solo-chain (Correct me if I am wrong here, does it need to be a validator IP or can it be any ...
- 3,632
2
votes
1
answer
148
views
How to deploy a hardened, secure, production-ready Substrate node?
I'm currently looking for a way to deploy the blockchain I'm working on and it has been a struggle to find out the best practices for doing so. The chain is based on the substrate-node-template but it ...
- 479
0
votes
1
answer
93
views
Different between safe and unsafe RPC calls
When running a substrate node, the CLI accepts a parameter called rpc_methods which accepts Auto, Safe and Unsafe arguments.
How can developers declare an RPC call Unsafe and how can one get the list ...
- 3
6
votes
1
answer
82
views
What factors determine who can peer with my node?
From a security standpoint I'd like to understand who can peer with my node. Let's say I make the chainspec public, and someone comes along with a different node binary, and peers with my node, with a ...
- 3,632
3
votes
1
answer
58
views
Is there any wargame-like for Substrate?
In my opinion, the best way to learn things is by practicing. The Substrate's tutorial (and docs) are already great on that matter.
But I have to say that I miss something around security there. I ...
- 912