search

leapdao / EthereumMachineOracle

8 stars 4 forks source link

Vulnerabilities in Oracle contract #25

Closed roleengineer closed 3 years ago

roleengineer commented 4 years ago
roleengineer commented 4 years ago

First one: Vulnerability is in a internal function _answerExists. If one party asks a question and waiting for correct answer, another party could ask another question and give answer for this another question (which is the correct answer for first question) and no one is able to give correct answer for first question. The only way to do it is to start to falsify all the answers for all the questions, but those correct answer could be correct for another question too, so such actions could block Oracle.