You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Realitio.submitAnswerCommitment assigns a commitment timeout of 1/8th of the question timeout.
Therefore for a high frequency application of Realitio with question timeout 2 minutes (plausible and not excluded by the docs), the commitment timeout is within the average block time. This behaviour is not documented. If interacting with Realitio via the Kleros RealitioArbitratorProxy, this enables a malicious miner to time out any commitment and claim the bounty.
Suggest Realitio.submitAnswerCommitment uses require(...) to enforce a minimum commitment timeout which is a safe multiple of the average block time. Or alternatively, commitment timeout/question timeout ratio is increased for short question timeouts.
Realitio.submitAnswerCommitment
assigns a commitment timeout of 1/8th of the question timeout.Therefore for a high frequency application of Realitio with question timeout 2 minutes (plausible and not excluded by the docs), the commitment timeout is within the average block time. This behaviour is not documented. If interacting with Realitio via the Kleros
RealitioArbitratorProxy
, this enables a malicious miner to time out any commitment and claim the bounty.Suggest
Realitio.submitAnswerCommitment
usesrequire(...)
to enforce a minimum commitment timeout which is a safe multiple of the average block time. Or alternatively, commitment timeout/question timeout ratio is increased for short question timeouts.See pacamara#1 for demonstration code.
(Issue identified from code review for bounty kleros/kleros-interaction#244 )
The text was updated successfully, but these errors were encountered: