Skip to main content
9 events
when toggle format what by license comment
Aug 23, 2018 at 16:12 comment added DenisM @Edmund Edgar It does plenty in fact. With just about every production contract utilizing Oraclize, the user requesting the query, is the one that incurs the Oraclize fees and is expected to provide enough value. Thereby this attack you are trying to display is not really viable, unless users are assumed to be irrational and don't bother to check how much value they are sending. Worst case, a user gets fooled once, reports/publicizes it forewarning others.
Aug 23, 2018 at 7:39 comment added Edmund Edgar That doesn't do much: 1 ETH per tx is a lot, you can call it repeatedly, and if the attacker is draining a contract they can also mine their own block and manipulate tx.gasprice at no cost. A somewhat less-bad response would be to control your fee with a contract that restrained the rate of increase, at least then people would have some hope of stopping using a contract before the attack did too much damage.
Aug 23, 2018 at 1:15 comment added Thomas Bertani The "guard against too high prices" that you mention, protecting the contracts against Oraclize abusing the cost settings, has been automatically used by all oraclize-based contracts for years: this is part of the oraclizeAPI.sol that all contracts include as you can see here @user1282931
Aug 22, 2018 at 15:38 comment added matthias_buehlmann Well, if I was them, I'd just wait until enough contracts use their code as in their example - at some point the incentive to then just drain these contracts (by setting the fees to 1 ether for example) is high enough and they'll just do that
Aug 22, 2018 at 15:35 comment added Jaime it is, but that's what a contract is, the parties accepted the rules (code in this case). On the other hand, oraclize has been around for long, no one complains about being robed by them.
Aug 22, 2018 at 15:20 comment added matthias_buehlmann But for deployed contracts that can't be changed, that is pretty crucial!!
Aug 22, 2018 at 15:16 comment added Jaime Yes, if you trust then they can rob you, that's why you should check the price as I am suggesting. And no, they can not take money from your contract, this imply that they can use a hidden function to stole the money without you executing something, but this is not the case. What happens is that they increase the price and if you accept that (or do not check it) then you pay for it next time you execute a call to their service.
Aug 22, 2018 at 15:11 comment added matthias_buehlmann Well, they can, if users implement their API the way they suggest in their examples. Have a look at github.com/oraclize/ethereum-examples/tree/master/solidity/… have a look at randomExample.sol - issuing the query will automatically send them ether from the contract based on a getPrice() method for which they can alter the return value. Of course, I could before making the query guard against too high prices - but their example does not do that. And if they raise prices and a contract does guard against it, it will cripple the contract.
Aug 22, 2018 at 15:02 history answered Jaime CC BY-SA 4.0