1

I am working on oracles. I saw this link - https://kndrck.co/posts/ethereum_oracles_a_simple_guide/

The code works, I tested it. But what is the issue to me, is the code actually secure? Can someone interrupt the message from the client.js to the smart contract and change the value?

There is not any TLS and no other way to confirm the correctness of the data.

This is the key js -

var OracleContract = require('./build/contracts/CMCOracle.json')
var contract = require('truffle-contract')

var Web3 = require('web3');
var web3 = new Web3(new Web3.providers.HttpProvider('http://localhost:8545'));
  • Secure in what context? Whoever's running the code can just have the oracle do whatever they want. Using an oracle means you're trusting that oracle. – user19510 Mar 10 '18 at 4:54
  • I meant more in terms of someone hijacking the transmissions between the smart contract and the http provider or in terms of faking the smart contract accessing the first place. – Trevor Lee Oakley Mar 10 '18 at 5:15
0

I am not sure if this will help you. According to what my professor said, oracle can only read the data from the blockchain, you can encrypt the smart contracts which are sending information to oracle. Doing more things on oracle means you will have more privacy than Ethereum. :)

| improve this answer | |
0

A smart contract cannot interact with the outside world because that would break determinism. In case that is hard to parse, for blockchain to work each node needs to be able to verify the whole chain now and in the future. There is no outside source of information that would be guaranteed to reproduce today's input at any point in the future, so it is off-limits.

The common solution to this problem is the Oracle pattern. In this context, an Oracle is an entity that is authorized to write some data the contract. The blockchain does not verify that authenticity of that data, but all nodes are able to agree, now and in the future, about what the Oracle said and what that means.

Therefore, the overall security (in this context, integrity of the data) is only as good as the Oracle. Therefore, to demonstrate the trustworthiness of the system, one must demonstrate why the Oracle should be trusted.

Hope it helps.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.