2

This contract has been out for a while (it's not mine). I wonder how secure it is. I understand encrypting & revealing process there, but what strikes me more is: When player1 calls method play with arguments string choice, string randStr, the fact that he called this method with those arguments is visible to all nodes on network, isn't it? Therefore player2 can search in blockchain transactions player1's call of play method and see choice? As far as I know transaction data isn't private.

Contract URL: https://github.com/SCBuergel/ethereum-rps/blob/master/rps-advanced.sol

3

Yes, knowing the ABI/code of the contract you can see which function is being executed and with which parameters in a specific transaction.

  • Thanks. Any suggestions how to make such contract more secure? – ma2s Oct 19 '16 at 12:37
  • 2
    My suggestion would be: 1.- Player1 hashes the choice with a random seed in local and sends the result to the contract. 2.- Player2 do the same. 3.- After both players have submitted their choice hashed, they have a period of time in which they have to send the choice and seeds used. 4a.- After that time, the contract recalculates the hash to make sure none of them is lying and declares a winner. 4b.- If one of the players doesn't submit the data, he loses. (*) Player 2 could do steps 2 and 3 in the same transaction, so only player1 has to do it or player2 wins. – AdrianClv Oct 19 '16 at 13:05
  • (**) Steps 3 and 4a could be executed in the same transaction from player1. 4b will be only executed by player2 after x amount of time. – AdrianClv Oct 19 '16 at 13:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.