0

EDIT: I need to edit the question since people did not understand what is it that I want to accomplish. Please consider this scenario:

  1. User uses a DAPP and initiates some smart-contract function, inputting some values.

  2. The smart contract then makes a RESTful GET call with those values to some centralized server. No, I don't need a POST, a GET with URL parameters is all I want to use while parsing the GET call.

  3. Centralized server processes those values that user entered.

Assuming there is no other way around for the data to travel from user to a server, what is the best way to implement the smart-contract so that the server does not get tricked into reacting to a forged GET call ?

8
  • Describe your case in full, since it is not clear from your question who interacts with whom and why
    – Mad Jackal
    Jan 4, 2021 at 15:13
  • Simplified: Oracle makes a GET call to a centralized server to initiate some function on a server. I want to accept the GET from Oracle and nothing else. How is this done (if possible) ? Jan 4, 2021 at 18:03
  • Is Oracle a smart-contract? If so, does it use the event mechanism? Or something else?
    – Mad Jackal
    Jan 4, 2021 at 18:13
  • 1
    After correcting the question, I figured out your problem. A smart-contract in Ethereum can only trigger any actions within the blockchain itself, but not in relation to any EXTERNAL actors. It can send a transaction, emit an event, or simply change its own state. In order to "catch" the reaction of Oracle smart-contract, it is necessary to install an Ethereum node and a special Dapp that will monitor events or transactions on the blockchain and process it.Events are generated at the moment the block is formed by the miner node and are included in the block, so their data cannot be forged.
    – Mad Jackal
    Jan 4, 2021 at 20:39
  • 1
    Thank you so much for taking your time to answer. Since I am using a JavaScript DAPP to start with (users can use it to withdraw and deposit tokens), I can interact with the server first, and then generate a partial private key on the server. By partial, I mean... half of the key is exposed, other is kept on a server. This way, I am using a contract as a filter and a centralized server to confirm that the data is authentic. Even if the key can be hacked, it would take too much time to intercept the intended route. There are also some other tweaks I can add to this approach... Jan 5, 2021 at 0:42

1 Answer 1

2

Your application works as such:

Dapp -> Oracle -> Server

And you're looking for help from the Oracle -> Server section.

This is a general security question and doesn't have anything to do with smart contracts or ETH as an Oracle can be any off-chain device, like a server itself.

You'll be looking to make an API call to your server through basic securities practices.

  1. Use HTTPS
  2. You could use a private network
  3. API Keys
  4. OAuth And more
5
  • Edited a question, sorry for misunderstanding... It is the oracle that makes the GET to a centralized server. Jan 4, 2021 at 18:52
  • Right. So the way it goes is like this: Dapp -> Oracle -> Server. You're looking for help making sure Dapp -> Oracle is good right? If yes, then this answer holds. Jan 4, 2021 at 18:59
  • No, I want to make sure that Oracle->Server is good, and the only one (not forged) :) Jan 4, 2021 at 19:00
  • 1
    Ah, this is a general security question then as it doesn't have anything to do with smart contracts. You'll be looking at things like OAuth and API key authorization. Jan 4, 2021 at 19:03
  • Ah crap! Thanks. I think that my own home-brewed solution will be a good one, which is to split the encrypted nonce and send a half with the user's initial call to a contract, and then combine it all within a server at the end... Please edit the answer and I will accept it :) Jan 4, 2021 at 19:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.