I'm trying to write a smart contract that can be generated by an individual given ETH/ERC-20 value to lock and a secret passphrase (hashed). Then, given that another individual sends the passphrase in plaintext over to the contract, and said passphrase matches the secret one's hash, have that contract deposit the value specified into their address. I'm accepting the possibility of brute forcing (this isn't a production app) but want to know, if msg.sender is publicly available info, is it possible for a Malicious Actor to intercept the correct answer (or any answer) and send it as their own, having the funds then deposited into Malicious Actor's address?


Yes, this is entirely possible if you constantly watch the public Ethereum mempool. Any transaction you execute would have to be first placed in the mempool, then it would linger there until picked by miners competing to mine the next block. To know more about this, lookup Blocknative's Mempool Explorer. The minimal steps to perform the attack attack would be as follows:

  1. Watch the target contract address for any incoming TXs, and possibly narrow the search to only look for incoming TXs made via the puzzle solution submission method call.
  2. Simulate each of those TXs and see if their execution results in the deposit of tokens into the sender's address.
  3. One you find out the jackpot TX, you can front-run it to get the prize (replay the TX and pay much higher gas to make sure it would be minded first).

There are many ways to prevent against such attack:

  1. Avoid the public mempool by sending your TXs directly to a dark pool node or an API like Flashbots.
  2. Require more data for the method input,like cryptographic proof that the sender is the one that solved the puzzle. That way, the TX would only be executed if sent from that particular sender address. Also, it would be for the best to avoid sending anything in plaintext (i.e., only send zero-knowledge proofs).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.