search

computablelabs / goest

Golang testing and sandbox for the Computable Protocol. 0xb00.
MIT License
8 stars 0 forks source link

Document Front-Running Attacks #128

Closed rbharath closed 5 years ago

rbharath commented 5 years ago

It's possible to front run creation of candidates in a market. That is, suppose I propose a candidate (for a listing, challenge, or datatrust) with listing hash 0xabc. Malicious actor Alice could watch for the unconfirmed transaction proposing this candidate and propose her own candidate with listing hash 0xabc. If her candidate is accepted before mine (perhaps due to higher gas offered), then Alice will own 0xabc. If I've submitted the data for 0xabc to the datatrust in the meanwhile, Alice might be able to fraudulently access this data by proving that she's the owner for 0xabc.

This attack requires some sophistication to execute, so the current plan is to document this attack (perhaps in http://github.com/computablelabs/compspec), but not create an explicit guard rail.

rbharath commented 5 years ago

Taken care of in https://computablelabs.github.io/compspec/docs/attacks/