search

bada-studio / knights_contract

154 stars 55 forks source link

Prevent brute force attack #19

Closed mjshin82 closed 5 years ago

mjshin82 commented 6 years ago

'valuenetwork' account tried brute force attack to get a best random value. Make random deterministic and also safe.

image

'valuenetwork' deployed our contract to 'valuenetwork' account. And then push rebirth and getgacha action to his contract. That contract just calculates a random value. When he got the best value, then he called 'eosknightsio' contract's same action.

mjshin82 commented 6 years ago

Step1 complete 'valuenetwork' has been banned. by 'Terms of use 5.4.'

mjshin82 commented 6 years ago

Step2 complete #14

mjshin82 commented 6 years ago

'ramcollector' also banned this account also tried brute force attack to get a best random value.

Abusing

He deployed our contract to 'gamblinguser' account then try craft to get the best value. He uses deprecated 'craft' action. "craft" and "craft2" return the same value with a 1/4 probability.

gamblinguser logs

Fixed

Changed the old and new versions to generate different random values