I am learning the security impact of smart contract on system properties like block.timestamp
and block.number
. I understood that block.timestamp
can be controlled by the miner to certain degree and therefore may be able to "beat the crowd" in some gambling games. Also, since the mining time of each block may vary, strictly speaking, the following code fragment may also cause certain confusions to users who are waiting for refund (e.g., a user is waiting until 99 minutes to ask for refund; however, since mining time becomes faster, the timing window has passed then):
// user can get refund with 100 minutes.
if (block.number < refund_window_end_block) {
// however, since block mining time may change from time to time
// the "refund_window_end_block" may not precisely depict "100 minutes".
refund();
}
I understood that there are some third-party oracle such that I can safely get some random numbers from. Similarly, can I leverage certain oracle to get a precise and reliable "timestamp" or duration time? Thank you.