All submitAnswer functions are front-runnable

[hats-bug-reporter[bot]]

Github username: -- Twitter username: -- Submission hash (on-chain): 0xa3d4e5242323ee490da9b267496747be8cba6ec6bc304ffa57160a721a7d3581 Severity: low

Description: Description

The submitAnswer and submitAnswerFor as stated in the comments, are front-runnable. However the submitAnswerCommitment and submitAnswerReveal function are also front-runnable. The reason is that there is no mechanism to prevent front-running, it only splits the submitAnswer function to two functions.

Attachments

1. Proof of Concept (PoC)

function submitAnswerCommitment(bytes32 question_id, bytes32 answer_hash, uint256 max_previous, address _answerer)
    stateOpen(question_id)
    bondMustDoubleAndMatchMinimum(question_id)
    previousBondMustNotBeatMaxPrevious(question_id, max_previous)
external payable {

    bytes32 commitment_id = keccak256(abi.encodePacked(question_id, answer_hash, msg.value));
    address answerer = (_answerer == NULL_ADDRESS) ? msg.sender : _answerer;
    _storeCommitment(question_id, commitment_id);
    _addAnswerToHistory(question_id, commitment_id, answerer, msg.value, true);

}
...
function submitAnswerReveal(bytes32 question_id, bytes32 answer, uint256 nonce, uint256 bond) 
    stateOpenOrPendingArbitration(question_id)
external {

    bytes32 answer_hash = keccak256(abi.encodePacked(answer, nonce));
    bytes32 commitment_id = keccak256(abi.encodePacked(question_id, answer_hash, bond));

    require(!commitments[commitment_id].is_revealed, "commitment must not have been revealed yet");
    require(commitments[commitment_id].reveal_ts > uint32(block.timestamp), "reveal deadline must not have passed");

    commitments[commitment_id].revealed_answer = answer;
    commitments[commitment_id].is_revealed = true;

    if (bond == questions[question_id].bond) {
        _updateCurrentAnswer(question_id, answer);
    }

    emit LogAnswerReveal(question_id, msg.sender, answer_hash, answer, nonce, bond);

}

2. Revised Code

The function submitAnswerCommitment should include the _answerer within the answer_hash , extract him and validate him, if the _answerer wasn’t equal to the extracted value from the answer_hash , it would revert and the function wouldn’t be maliciously front-runnable.