# Security **URL:** https://forum.openzeppelin.com/c/security/25.md?page=3 [Latest](https://forum.openzeppelin.com/latest.md) · [Categories](https://forum.openzeppelin.com/categories.md) · [Tags](https://forum.openzeppelin.com/tags.md) **Page:** 4 --- ## [Reflecting on the NBAxNFT drop failure](https://forum.openzeppelin.com/t/reflecting-on-the-nbaxnft-drop-failure/28482)
**Author:** [@slw.eth](https://forum.openzeppelin.com/u/slw.eth)\ **Replies:** 0\ **Last updated:** [May 7, 2022, 9:00pm UTC](https://forum.openzeppelin.com/t/reflecting-on-the-nbaxnft-drop-failure/28482 "2022-05-07T21:00:43Z")
Failed NFT drops are all too common. It's important for developers to take a security-first approach when building decentralized applications. A lot can be learned by studying what went wrong. To that end, one of OpenZ… --- ## [Ethernaut lvl 22,23](https://forum.openzeppelin.com/t/ethernaut-lvl-22-23/28177)
**Author:** [@Team\_X](https://forum.openzeppelin.com/u/Team_X)\ **Replies:** 0\ **Last updated:** [April 29, 2022, 10:32am UTC](https://forum.openzeppelin.com/t/ethernaut-lvl-22-23/28177 "2022-04-29T10:32:49Z")
Fun fact the dex has a function called function approve(address spender, uint amount) public { SwappableTokenTwo(token1).approve(spender, amount); SwappableTokenTwo(token2).approve(spender, amount); } now y… --- ## [What cryptography algorithm is used to generate a seed phrase?](https://forum.openzeppelin.com/t/what-cryptography-algorithm-is-used-to-generate-a-seed-phrase/28155)
**Author:** [@cizrim](https://forum.openzeppelin.com/u/cizrim)\ **Replies:** 0\ **Last updated:** [April 28, 2022, 10:11pm UTC](https://forum.openzeppelin.com/t/what-cryptography-algorithm-is-used-to-generate-a-seed-phrase/28155 "2022-04-28T22:11:22Z")
What algorithm is used to generate a seed phrase for the Bitcoin wallets? I am guessing it could be Elliptic Curve, maybe EC25519 --- ## [Defender Sentinels support monitoring HECO network?](https://forum.openzeppelin.com/t/defender-sentinels-support-monitoring-heco-network/27924)
**Author:** [@Amanda\_Vaughan](https://forum.openzeppelin.com/u/Amanda_Vaughan)\ **Replies:** 0\ **Last updated:** [April 23, 2022, 12:58pm UTC](https://forum.openzeppelin.com/t/defender-sentinels-support-monitoring-heco-network/27924 "2022-04-23T12:58:02Z")
I want to use Sentinels to listen to a smart contract on the heco network, there is currently no option for this network? Can I create Sentinels using the - Sentinel client api? --- ## [Ethernaut level 13, Gatekeeper One, can't find proper gas value](https://forum.openzeppelin.com/t/ethernaut-level-13-gatekeeper-one-cant-find-proper-gas-value/27850)
**Author:** [@viboracecata](https://forum.openzeppelin.com/u/viboracecata)\ **Replies:** 0\ **Last updated:** [April 21, 2022, 4:30pm UTC](https://forum.openzeppelin.com/t/ethernaut-level-13-gatekeeper-one-cant-find-proper-gas-value/27850 "2022-04-21T16:30:33Z")
Hi, community, I'm trying to break ethernaut level 13, I have a simple sol source code, as below: contract Hack { using SafeMath for uint256; GatekeeperOne public gkp; bytes8 txOrigin16 = 0x0123456789abcde… --- ## [Question regards function wrappers](https://forum.openzeppelin.com/t/question-regards-function-wrappers/26105)
**Author:** [@Allennick](https://forum.openzeppelin.com/u/Allennick)\ **Replies:** 0\ **Last updated:** [March 13, 2022, 1:34pm UTC](https://forum.openzeppelin.com/t/question-regards-function-wrappers/26105 "2022-03-13T13:34:04Z")
Hi everyone! Why does OpenZeppelin use function wrappers? For example: function nameOfFunction() { \_nameOfFunction(); } function \_nameOfFunction() {....} I think this is for security reason but I'm not sure about… --- ## [Question on Contracts Wizard](https://forum.openzeppelin.com/t/question-on-contracts-wizard/25807)
**Author:** [@Allennick](https://forum.openzeppelin.com/u/Allennick)\ **Replies:** 2\ **Last updated:** [March 9, 2022, 8:13am UTC](https://forum.openzeppelin.com/t/question-on-contracts-wizard/25807 "2022-03-09T08:13:04Z")
Hi everyone, is Contracts Wizard safe to use? I need to develop a Smart Contract for a client and I was thinking of using this generator and then start to work on it. --- ## [Damn Vulnerable DeFi - Challenge #3 Walkthrough](https://forum.openzeppelin.com/t/damn-vulnerable-defi-challenge-3-walkthrough/4745)
**Author:** [@iphelix](https://forum.openzeppelin.com/u/iphelix)\ **Replies:** 2\ **Last updated:** [March 8, 2022, 5:14am UTC](https://forum.openzeppelin.com/t/damn-vulnerable-defi-challenge-3-walkthrough/4745 "2022-03-08T05:14:41Z")
Another fun challenge, this one with a real world hack example: --- ## [Deploy smart contract usign Ledger Hard Wallet](https://forum.openzeppelin.com/t/deploy-smart-contract-usign-ledger-hard-wallet/25624)
**Author:** [@FolksJ](https://forum.openzeppelin.com/u/FolksJ)\ **Replies:** 1\ **Last updated:** [March 4, 2022, 7:30pm UTC](https://forum.openzeppelin.com/t/deploy-smart-contract-usign-ledger-hard-wallet/25624 "2022-03-04T19:30:15Z")
To improve the security of the contract, can I deploy it using a Hard Wallet connected to the Metamask? --- ## [Using keccak256 to password protect functions, similar to a commit-reveal setup](https://forum.openzeppelin.com/t/using-keccak256-to-password-protect-functions-similar-to-a-commit-reveal-setup/25418)
**Author:** [@MetalGearSolidity](https://forum.openzeppelin.com/u/MetalGearSolidity)\ **Replies:** 2\ **Last updated:** [February 28, 2022, 4:53pm UTC](https://forum.openzeppelin.com/t/using-keccak256-to-password-protect-functions-similar-to-a-commit-reveal-setup/25418 "2022-02-28T16:53:15Z")
Hello friends, I am looking for opinions and potential pitfalls to this idea. I want to mint ERC-720 tokens and give each one a unique password in order to interact and function with that induvial NFT. I would generate… --- ## [Two transactions in the same time, (Teoric Question)](https://forum.openzeppelin.com/t/two-transactions-in-the-same-time-teoric-question/25416)
**Author:** [@Cainuriel](https://forum.openzeppelin.com/u/Cainuriel)\ **Replies:** 1\ **Last updated:** [February 28, 2022, 1:19am UTC](https://forum.openzeppelin.com/t/two-transactions-in-the-same-time-teoric-question/25416 "2022-02-28T01:19:04Z")
We have an accountant in a contract that goes up when called. We have two transactions coming in at the same time from the same state contract. Contract state: counter = 1 Transaction one: ++; Transaction two: ++; T… --- ## [Upgradeable contracts: Best practice around using \`onlyProxy\`](https://forum.openzeppelin.com/t/upgradeable-contracts-best-practice-around-using-onlyproxy/25160)
**Author:** [@dawit](https://forum.openzeppelin.com/u/dawit)\ **Replies:** 0\ **Last updated:** [February 22, 2022, 7:27pm UTC](https://forum.openzeppelin.com/t/upgradeable-contracts-best-practice-around-using-onlyproxy/25160 "2022-02-22T19:27:15Z")
I'm curious what the general recommendation is around using onlyProxy to protect direct calls to the implementation contract. It is my understanding that the only way the implementation contract could interfere with the… --- ## [OpenZeppelin security concerns](https://forum.openzeppelin.com/t/openzeppelin-security-concerns/25059)
**Author:** [@\_Sky](https://forum.openzeppelin.com/u/_Sky)\ **Replies:** 0\ **Last updated:** [February 21, 2022, 10:16am UTC](https://forum.openzeppelin.com/t/openzeppelin-security-concerns/25059 "2022-02-21T10:16:53Z")
Hi, How to contact OpenZeppelin staff in the case of security concerns regarding one of the Smart Contracts in the openZeppelin library. This request is in regards to a possible exploit. --- ## [Delegation - confused about alternative solution](https://forum.openzeppelin.com/t/delegation-confused-about-alternative-solution/24277)
**Author:** [@ethernaut1](https://forum.openzeppelin.com/u/ethernaut1)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 5:29pm UTC](https://forum.openzeppelin.com/t/delegation-confused-about-alternative-solution/24277 "2022-02-08T17:29:16Z")
I am going through the Ethernaut challenges using brownie. For challenge number 6 - Delegation, I have two solutions which work. Solution1 seems to be the intended way to solve the challenge as we can only interact with… --- ## [Beginner looking for answers about malicious contracts](https://forum.openzeppelin.com/t/beginner-looking-for-answers-about-malicious-contracts/21781)
**Author:** [@baron](https://forum.openzeppelin.com/u/baron)\ **Replies:** 3\ **Last updated:** [February 1, 2022, 3:22pm UTC](https://forum.openzeppelin.com/t/beginner-looking-for-answers-about-malicious-contracts/21781 "2022-02-01T15:22:12Z")
I have no idea what I'm doing I'll be honest, the furthest I ever got with code was html websites. I found a contract by a fake nft page and was wondering what people here would look for to spot anything scam or hack re… --- ## [Is Audit needed for OpenZeppelin's Wizard Template?](https://forum.openzeppelin.com/t/is-audit-needed-for-openzeppelins-wizard-template/23539)
**Author:** [@alfainfotech](https://forum.openzeppelin.com/u/alfainfotech)\ **Replies:** 5\ **Last updated:** [January 28, 2022, 6:20pm UTC](https://forum.openzeppelin.com/t/is-audit-needed-for-openzeppelins-wizard-template/23539 "2022-01-28T18:20:47Z")
Hello, If we created ERC20 using OpenZeppelin's Contracts Wizard template and published in remix on mainnet with only change in wizards as token name, symbol and units and burnable... do we still need to get Audit ? if … --- ## [Level 13 - figure out gas price](https://forum.openzeppelin.com/t/level-13-figure-out-gas-price/23103)
**Author:** [@skimaharvey](https://forum.openzeppelin.com/u/skimaharvey)\ **Replies:** 1\ **Last updated:** [January 21, 2022, 11:09am UTC](https://forum.openzeppelin.com/t/level-13-figure-out-gas-price/23103 "2022-01-21T11:09:04Z")
Hello, I was looking at this solution https://medium.com/coinmonks/ethernaut-lvl-13-gatekeeper-1-walkthrough-how-to-calculate-smart-contract-gas-consumption-and-eb4b042d3009 I was trying to figure out the gas price. As… --- ## [Permissionless, yet Secure Execution of Smart Contracts](https://forum.openzeppelin.com/t/permissionless-yet-secure-execution-of-smart-contracts/23057)
**Author:** [@Richard\_Zhang](https://forum.openzeppelin.com/u/Richard_Zhang)\ **Replies:** 0\ **Last updated:** [January 20, 2022, 6:26pm UTC](https://forum.openzeppelin.com/t/permissionless-yet-secure-execution-of-smart-contracts/23057 "2022-01-20T18:26:56Z")
Hello, I am wondering if there's a way for users to be able to interact with assets on my ERC1155 contract in a permissionless way, so users have full-control of their assets. But at the same time, we would like users t… --- ## [Pick functions in OZ standard library to save gas](https://forum.openzeppelin.com/t/pick-functions-in-oz-standard-library-to-save-gas/21373)
**Author:** [@noberk](https://forum.openzeppelin.com/u/noberk)\ **Replies:** 4\ **Last updated:** [January 9, 2022, 5:11am UTC](https://forum.openzeppelin.com/t/pick-functions-in-oz-standard-library-to-save-gas/21373 "2022-01-09T05:11:23Z")
Is it possible to select functions to use in OZ standard library not including all functions to waste gas? in a nutshell, use them in need. --- ## [Gas effective deployment method secure?](https://forum.openzeppelin.com/t/gas-effective-deployment-method-secure/22274)
**Author:** [@helio.rosa](https://forum.openzeppelin.com/u/helio.rosa)\ **Replies:** 0\ **Last updated:** [January 6, 2022, 8:35pm UTC](https://forum.openzeppelin.com/t/gas-effective-deployment-method-secure/22274 "2022-01-06T20:35:11Z")
I'm currently working on a dex project that allows users to create contracts for the trading pairs and wanted to reduce the cost of deployment. Came up with the solution below, a very small proxy (51 bytes, 64 with cons… --- ## [Sending in solidity](https://forum.openzeppelin.com/t/sending-in-solidity/21847)
**Author:** [@arty\_bln](https://forum.openzeppelin.com/u/arty_bln)\ **Replies:** 7\ **Last updated:** [December 29, 2021, 7:20pm UTC](https://forum.openzeppelin.com/t/sending-in-solidity/21847 "2021-12-29T19:20:10Z")
Hi guys Im new and try to learn solidity to be able to deploy my first dApp. I've seen different functions for sending, what are differencies bettween? (bool sent,) = msg.sender.call{value: value}(""); payable(msg.sen… --- ## [DeFi Threat Matrix v3 - Feedback and Contributions welcomed](https://forum.openzeppelin.com/t/defi-threat-matrix-v3-feedback-and-contributions-welcomed/21613)
**Author:** [@sambacha](https://forum.openzeppelin.com/u/sambacha)\ **Replies:** 0\ **Last updated:** [December 25, 2021, 3:11pm UTC](https://forum.openzeppelin.com/t/defi-threat-matrix-v3-feedback-and-contributions-welcomed/21613 "2021-12-25T15:11:14Z")
DeFi Threat Matrix Last year right after the bZk/fulcrum hack I started working on a MITRE ATT&K Threat Matrix equivalent for DeFi/smart contract protocols/applications.. for a proper release I am hoping to re-categoriz… --- ## [Does anyone recognize this hacking method?](https://forum.openzeppelin.com/t/does-anyone-recognize-this-hacking-method/21219)
**Author:** [@maxareo](https://forum.openzeppelin.com/u/maxareo)\ **Replies:** 0\ **Last updated:** [December 19, 2021, 12:10pm UTC](https://forum.openzeppelin.com/t/does-anyone-recognize-this-hacking-method/21219 "2021-12-19T12:10:46Z")
Hey guys, please take a look at this transaction. Someone was able to steal ERC20 tokens from a liquidity pool. A skim attack is possible, but given selfdestruct seems to be used, wondering if there's anything deeper tha… --- ## [The most "trustless" solution for an off-chain computation step? Is autotask any good for this?](https://forum.openzeppelin.com/t/the-most-trustless-solution-for-an-off-chain-computation-step-is-autotask-any-good-for-this/21170)
**Author:** [@sptumbo](https://forum.openzeppelin.com/u/sptumbo)\ **Replies:** 0\ **Last updated:** [December 18, 2021, 12:40am UTC](https://forum.openzeppelin.com/t/the-most-trustless-solution-for-an-off-chain-computation-step-is-autotask-any-good-for-this/21170 "2021-12-18T00:40:57Z")
Hello all, I am trying to find the best solution to mint ERC721 NFT tokens when a user presents a specific "voucher". Since this voucher would not only be linked to the blockchain address of its owner but also partly to… --- ## [Can someone help me understand this attack?](https://forum.openzeppelin.com/t/can-someone-help-me-understand-this-attack/20490)
**Author:** [@Meric](https://forum.openzeppelin.com/u/Meric)\ **Replies:** 1\ **Last updated:** [December 8, 2021, 6:31pm UTC](https://forum.openzeppelin.com/t/can-someone-help-me-understand-this-attack/20490 "2021-12-08T18:31:12Z")
He basically SWAPS 0.000000001 BNB for some otkens, and then somehow swaps more tokens that he got for \> 1.71 BNB. I would like to understand where the vulnerability is (I assume in the token, obviously not in panckae… --- ## [Smart Contract Audit ](https://forum.openzeppelin.com/t/smart-contract-audit/20845)
**Author:** [@joffrey](https://forum.openzeppelin.com/u/joffrey)\ **Replies:** 2\ **Last updated:** [December 14, 2021, 9:08pm UTC](https://forum.openzeppelin.com/t/smart-contract-audit/20845 "2021-12-14T21:08:15Z")
Hello I have a solidity code to audit like this pragma solidity ^0.8.0; import "@openzeppelin/contracts/token/ERC20/IERC20.sol"; // Allow to split the balance through complex rules interface Split{ function getAddre… --- ## [Validate Signature Owner with Web3](https://forum.openzeppelin.com/t/validate-signature-owner-with-web3/20745)
**Author:** [@anarkrypto](https://forum.openzeppelin.com/u/anarkrypto)\ **Replies:** 1\ **Last updated:** [December 14, 2021, 4:34am UTC](https://forum.openzeppelin.com/t/validate-signature-owner-with-web3/20745 "2021-12-14T04:34:31Z")
Using web3.wallet.accounts.recover(message, signature) I get the account I used to sign. This is enough to ensure that the signature was made by the returned account ? Web3js API Doc says it "Recovers the Ethereum addr… --- ## [Flux Coin deposited to Binance](https://forum.openzeppelin.com/t/flux-coin-deposited-to-binance/20726)
**Author:** [@Ali\_Zeeshan\_Cheema](https://forum.openzeppelin.com/u/Ali_Zeeshan_Cheema)\ **Replies:** 0\ **Last updated:** [December 10, 2021, 11:58am UTC](https://forum.openzeppelin.com/t/flux-coin-deposited-to-binance/20726 "2021-12-10T11:58:36Z")
Hey everyone. I withdrawn my $FLUX tokens from MEXC Exchange to Binance Exchange. Mexc is showing success status as well as Blockchain transaction is also in success status. But my tokens have not yet arrived at my Bi… --- ## [Urgent major security in smart contract need help](https://forum.openzeppelin.com/t/urgent-major-security-in-smart-contract-need-help/20250)
**Author:** [@Levarye007\_A](https://forum.openzeppelin.com/u/Levarye007_A)\ **Replies:** 2\ **Last updated:** [December 8, 2021, 4:47pm UTC](https://forum.openzeppelin.com/t/urgent-major-security-in-smart-contract-need-help/20250 "2021-12-08T16:47:44Z")
Hello All, I need help urgently and I believe what I found is effecting millions of people. I found a major vernability in Opensea with Nfts and in metamask wallet, uniswap and all other apps.... I need help to remove … --- ## [Recovery to arbitrary signature](https://forum.openzeppelin.com/t/recovery-to-arbitrary-signature/20568)
**Author:** [@Jeffrey\_Scholz](https://forum.openzeppelin.com/u/Jeffrey_Scholz)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 4:34pm UTC](https://forum.openzeppelin.com/t/recovery-to-arbitrary-signature/20568 "2021-12-08T16:34:39Z")
The ECDSA code warns us here: https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/utils/cryptography/ECDSA.sol#L46 IMPORTANT: hash must be the result of a hash operation for the verification to … [Previous page](https://forum.openzeppelin.com/c/security/25.md?page=2) [Next page](https://forum.openzeppelin.com/c/security/25.md?page=4)