What is a good way to put the equivalent of a captcha in a Solidity contract? The objective is to put in a filter to make it difficult for bots to monopolize the contract, allowing regular humans to have access. For example, I could put in a string like 'what is seven times eight' or 'what are the first 5 digits of pi'? and then a user would have to input the answer with his transaction.


Short answer:


Better answer:

I'll go a little bit out on a limb and suggest that the need for a CAPTCHA suggests an underlying design issue that needs to be discovered, defined and addressed.

Bots, other contracts and humans are (generally) indistinguishable, by design. Contracts are designed to enforce rules reliably. The rules can enforce business logic and assure incentives that make systems work economically. I would suggest decomposing the concerns that make it seem like differentiating between humans and bots (who play by the rules) is a good idea or necessary. In summary, you shouldn't want to.

Is it a spam concern, regulatory concern, something else?

I would be open-minded about fundamental requirements that are not anticipated but my instinct is that this a presumptive solution to a set of unknown concerns. It only looks like a requirement. It may be pointing the way to a critical oversight so I would work on bringing that into to the open.


Hope it helps.

  • 1
    For many dapps the goal is reaching humans who are casual crypto users, and avoiding a nefarious troll who just wants to hamstring your dapp. If I asked "How old is Donald Trump?", and created a similar question every other day, a bot could automate a script to get around this but it would be a lot of work. Given these trolls have no pecuniary upside, just pleasure in gumming stuff up, they would probably move on. Apr 23 '20 at 14:19
  • I don't want to seem argumentative, but the patterns are different and your comment reinforces my point even though I don't think that was your intention. First, a contract cannot know how old Donald Trump without an assist from Oracle, itself a privileged user who signs a transaction and the contract will authenticate it before paying attention (think revert). So, anyone can pretend to be the Oracle and it just costs them gas. The system would be indifferent to their mischief. May 7 '20 at 2:29
  • Maybe it's a forecasting game. "Guess the temp at Chicago, runway 27L at high noon, tomorrow. Bet now. Bet often!" It is usually the goal to attract users, and it's okay if there is lots of competition. Once again, an Oracle will have to declare the actual temperature so the contract can declare a winner. May 7 '20 at 2:32
  • My point is if the economics are sound and the contract security is sound, then bots are okay, and bots participating may be an indication of success. "Boredom" is not a sufficient defence. It needs to be economically infeasible to disrupt the proper functioning of the system. It's simple with rules-based systems and access-control lists. Less-so with incentive-driven models, particularly in the realm of (possible) interactions with other systems. It might help to consider that the contracts do not exist in a humans-only world but it is a world of consistently-applied rules. May 7 '20 at 2:37
  • Per comment #1 it would be feasible to put in Trump's age, which changes annually, and the only target is bots. Excluding bots would not affect the incentives of users much, especially if a parameter like TrumpAge was public. This would be a simple parameter, controlled by the administrator, that would leave a public record for all to see (eg, event log of q and a). I'm focused on malicious trolls, those w/o a gain, but who who like to gum things up for fun. May 8 '20 at 3:20

Unfortunately CAPTCHA paradigm is based on the introduction, from outside, of a data to be decoded. This means that there is not some locally inspectable code to use as a guideline to answer the question. This is not the case in ethereum smart contract, which are inspectable by definition. In such a way any internal code useful to understand if the question has been properly answered is available to design the bot.

The only solution can be using oracles, i.e. systems out of the chain which interface your contract by the web or whatsoever.

Nothing strange to interface the true CAPTCHA server at that point or something similar.

Anyway, may be that it be a wrong paradigm for the blockchain and a costly implementation with minor real world results.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.