2

I looked through the code of the oraclize api, and it seems that oraclize can swap out keyportions of the implementation at will. In particular, it looks like they can adjust the pricing for their API pretty much at will any time - so they could drain all ether from contracts that access their API quite easily.

Whom exactly are we trusting here by using their API? I didn't find any faces on their website.

1

Regarding the code of the Oraclize API, this is something other contracts inherit. Once the contract inheriting this API is deployed, no one can go and change what's in the API. Additionally the code is of course open source, and if anything fishy was ever done, it would be on the github commit histories to be visible.

There are some other contracts the API does depend on, namely the resolver and connector, which are updateable by Oraclize, nonetheless, the API already in fact has safeguards in place for users to prevent contracts being drained by just upping to unreasonable prices: https://github.com/oraclize/ethereum-api/blob/master/oraclizeAPI_0.5.sol#L377

This line will cause the query to fail if Oraclize wants 1 or more ether for a query (this value was from when 1 ETH was valued lower, it may be a good idea for Oraclize to lower this, however, anyone inheriting the contract can literally change that value in the API to suit them and provide the safeguard they need).

The examples referenced, are meant to be just that, simple barebones examples showcasing use of Oraclize (with a focus on just some of the basic methods), it is not meant to be an exhaustive project. It is good you bring up these concerns, and you should treat Oraclize and its operators as anonymous (even if they are not, more on that later) and as mentioned previously the safeguards are already in, and you can fine tune them as you may need to.

It would be interesting to compile some data of the amount of contracts utilizing Oraclize, that have balances over 1 ETH, and the amount that Oraclize would gain by draining 1 ETH from them. That amount would probably be much less I presume then Oraclize does indeed make by behaving honestly and doing hundreds of queries a day, so the incentive to stay honest ought to be there, a breach is another thing, but the current 1 ETH protection should curtail the potential earnings of that, and is something Oraclize should lower, and maybe recommend users to set as per their needs.

About Oraclize being anonymous, it is over 3 years old as a company, I myself am with Oraclize and have been for a few years now. We attend and sponsor multiple conferences and have conduced speaking events throughout the years, ranging from Devcon, to ETHWaterloo, to Oraclize meetups. The CEO of the company, Thomas Bertani, is quite renowned in the space. It is best to track this activity via the official Oraclize twitter: https://twitter.com/oraclizeit and there's also videos you can find on youtube if it's of interest.

I hope this clarifies on who Oraclize is and the already existing protection for users inheriting its contracts, from arbitrarily being able to drain contracts beyond 1 ETH (assuming they are using the standard value, could be lower for those that have changed it for their security). Regardless of my overview on who Oraclize is and to show there are in fact faces behind it, you should still not trust Oraclize based just on reputation and faces, hence why the aforementioned code is open-source, you use it and format it to your needs, and additionally why Oraclize invests so much in working on authenticity proofs, so even with the data fetching portion, you are not trusting Oraclize at all, and have guarantees that no data-tampering occurred, unlike other oracles which completely expect you to depend on their reputation, or the reputation of a single other entity/mechanism.

0

They can not take money from your contract. When you request data, is you who place the order. What is a bad idea is just to send orders without checking how much you will be paying, that is, always check the value of the fee before making a call.

Hope this helps.

  • Well, they can, if users implement their API the way they suggest in their examples. Have a look at github.com/oraclize/ethereum-examples/tree/master/solidity/… have a look at randomExample.sol - issuing the query will automatically send them ether from the contract based on a getPrice() method for which they can alter the return value. Of course, I could before making the query guard against too high prices - but their example does not do that. And if they raise prices and a contract does guard against it, it will cripple the contract. – user1282931 Aug 22 '18 at 15:11
  • Yes, if you trust then they can rob you, that's why you should check the price as I am suggesting. And no, they can not take money from your contract, this imply that they can use a hidden function to stole the money without you executing something, but this is not the case. What happens is that they increase the price and if you accept that (or do not check it) then you pay for it next time you execute a call to their service. – Jaime Aug 22 '18 at 15:16
  • But for deployed contracts that can't be changed, that is pretty crucial!! – user1282931 Aug 22 '18 at 15:20
  • 1
    The "guard against too high prices" that you mention, protecting the contracts against Oraclize abusing the cost settings, has been automatically used by all oraclize-based contracts for years: this is part of the oraclizeAPI.sol that all contracts include as you can see here @user1282931 – Thomas Bertani Aug 23 '18 at 1:15
  • 2
    @Edmund Edgar It does plenty in fact. With just about every production contract utilizing Oraclize, the user requesting the query, is the one that incurs the Oraclize fees and is expected to provide enough value. Thereby this attack you are trying to display is not really viable, unless users are assumed to be irrational and don't bother to check how much value they are sending. Worst case, a user gets fooled once, reports/publicizes it forewarning others. – DenisM Aug 23 '18 at 16:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.