0

I am learning the security impact of smart contract on system properties like block.timestamp and block.number. I understood that block.timestamp can be controlled by the miner to certain degree and therefore may be able to "beat the crowd" in some gambling games. Also, since the mining time of each block may vary, strictly speaking, the following code fragment may also cause certain confusions to users who are waiting for refund (e.g., a user is waiting until 99 minutes to ask for refund; however, since mining time becomes faster, the timing window has passed then):

    // user can get refund with 100 minutes.
    if (block.number < refund_window_end_block) {
     // however, since block mining time may change from time to time 
     // the "refund_window_end_block" may not precisely depict "100 minutes".
         refund();
    }

I understood that there are some third-party oracle such that I can safely get some random numbers from. Similarly, can I leverage certain oracle to get a precise and reliable "timestamp" or duration time? Thank you.

1

To begin with, any oracles you use are centralized services which means you have to trust a company/organization to provide the right information. That also means that you have to trust that their services are up and running when you need them. This contradicts the decentralized & trustless nature of Ethereum contracts.

To use an oracle to get a timestamp is not very feasible. Oracles do not magically give you the data the instant you request it. The process may take some time while you wait for an oracle to submit the data into the blockchain and for your contract to get the data. So that method is not suitable for getting any precise timestamp information.

Otherwise you are correct that miners can game the timing a bit. But in practice they won't do it unless the reward is big enough.

There is no concept of "exact time" or measuring exact time in Ethereum. The best you have are the block.number and block.timestamp (equals to now).

  • Thanks Lauri. I am just thinking that although using the block.number to calculate a duration seems common, that actually leads to confusions to the user. I see some contract source code with comments saying that "refund ends after 2 month". However, it is actually not very precise since the mining block time changes. – lllllllllllll Aug 9 at 6:25
  • 1
    Both (now and block.number) have their own problems. Evaluate their strengths and weaknesses and decide on what is best for your use case (or maybe a combination of those two) – Lauri Peltonen Aug 9 at 6:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.