I'm trying to limit the access of functions in my contract to only normal user addresses, to prevent the 'revert-and-retry attack' described here.
Quick excerpt from that link:
victim.tryMyLuck(); require(victim.conditionOutcome() == favorable);
In other words, the attacker can choose to commit a transaction only when the outcome of a “random” trial is favorable, and abort otherwise. The only cost in the latter case is minor: the gas spent to execute the transaction. The attack works even if there is value transfer in the tryMyLuck() trial: if the transaction aborts, its effects are reverted.
Back to the question: Is it possible to
require() transactions to come from user addresses and block contracts?