I'm designing a dApp where users can submit work they've done (files) to ipfs/swarm. To get credit for the work they then reference the hash of the files when calling a smart contract. What are some ways I might avoid front-running attacks (i.e. someone trolling pending transactions for work submitted, read a file hash, and use more gas to jump to the front of the line, and get credit for someone else's work)?
I'm not very familiar with state channels, but based on my understanding it is one possible solution (although then I'm sacrificing decentralization by having to coordinate the transactions).
There is a reputation component to the app, so maybe some sort of consensus mechanism that burns user reputation/funds if they are deemed fraudulent. Although this requires another layer of approvals/consensus before the work can be considered 'done' and I'm not sure exactly how would be able to could detect fraud.
Is there a simpler solution I'm not seeing? Any thoughts are welcome.
EDIT: I can imagine a two-transaction sequence where someone submits an integer that is the hash modulo their address (or something) followed (once settled) by another transaction with the actual hash, which can now be verified. Not sure if there's anything better.