Revert if caller of contract is another contract [duplicate]

Question

I'm trying to limit the access of functions in my contract to only normal user addresses, to prevent the 'revert-and-retry attack' described here.

Quick excerpt from that link:

victim.tryMyLuck();
require(victim.conditionOutcome() == favorable);

In other words, the attacker can choose to commit a transaction only when the outcome of a “random” trial is favorable, and abort otherwise. The only cost in the latter case is minor: the gas spent to execute the transaction. The attack works even if there is value transfer in the tryMyLuck() trial: if the transaction aborts, its effects are reverted.

Back to the question: Is it possible to require() transactions to come from user addresses and block contracts?

Answer 1

You can require that a call comes from a contract address by checking that the callers contract size (calledEXTCODESIZE) exceeds zero .

But you can't require that it come from a user address. The problem with the second statement is that a contract has a contract size of zero during construction.

Answer 2

If you want to limit the access of functions in your Smart contract to only normal user addresses.

Insert this in 1st line of your function:

require(msg.sender.code.length == 0, "Only normal user allowed, Smart Contracts not allowed");

msg.sender return the Address of the one who call the function

0xAddress.code return ByteCode of any address. Which is nothing for normal user Address.

e.g. if OnlyTrueUsersCanCall() function will be called, it would return true for normal users, and false for bots/SmartContracts. In true part, you can include further steps.

pragma solidity >= 0.8.0 < 0.9.0;
contract StoreData  {
  function OnlyTrueUserCanCall() public view returns(bool){
    if(msg.sender.code.length==0){
      return(true);
      // do your stuff here
    }else{
      return(false);
    //in case of bot or smart conract call the function
    }
  }
}

Answer 3

The open zeppelin address library has an “isContract” function you can use to check whether or not a call is coming from a contract or EOA