Let's say I have the following in my smart contract:

string passwordHash;
uint money;
function checkPassword(string cleanPassword, string newPasswordHash)[...]

When running the function checkPassword, I run it with the clean password. The clean password is then checked as sha256 with the passwordHash and if it's correct, the sender (normally me) gets the funds. But now following problem:

What if someone spectates my address, runs a transaction with more gas and gets "selected" before me: Is there a way to prevent someone "stealing the password from my transaction"? Is the only way to me run with more than enough gas?


No, there is nothing you can do in order to be mined before someone if not paying more gas than he pays...

This is called the problem of the Man in the Middle (MIM) and exist for mining as well.

What you can truly do is to find a way to use the msg.sender as part of the valid hash. When he shall try to reuse your “password, he simply do not succeed because his address is different from your.

I.e. the password must be related to the address of the user.

  • Thank you! What if the address can't be used and everyone should be able to call? I want to develop a retreive function where I can access the funds when for example my private key gets hacked or lost but I for example have stored the password in another safe space (as I do not need the password generally but for the private key there are more attacking points). The password is then similar to a private key in terms of length and randomness. But it shouldn't be able to be called before me. – dkb Feb 8 at 21:14
  • This problem is unsolved without a zero knowledge approach or something similar. Try to read about zsnark and similar zero knowledge algorithms. There is a lot of articles on this argument. At the moment does not exist something very simple able to do what you want, not in Ethereum using solidity, but a lot of work is on going on the matter. – Rick Park Feb 8 at 22:36

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.