Skip to content

Commit

Permalink
Update SWC-136 (comment samples, note no maintenance)
Browse files Browse the repository at this point in the history
  • Loading branch information
chaals authored Sep 1, 2023
2 parents c54eb1b + fe741aa commit 6d2f140
Showing 1 changed file with 24 additions and 0 deletions.
24 changes: 24 additions & 0 deletions entries/docs/SWC-136.md
Original file line number Diff line number Diff line change
@@ -1,3 +1,15 @@
# Please note, this content is no longer actively maintained.

The content of the SWC registry has not been thoroughly updated since 2020. It is known to be incomplete and may contain errors as well as crucial omissions.

For currently maintained guidance on known Smart Contract vulnerabilities written primarily as guidance for security reviewers, please see the
[EEA EthTrust Security Levels specification](https://entethalliance.org/specs/ethtrust-sl). As well as the latest release version, an
[Editor's draft](https://entethalliance.github.io/eta-registry/security-levels-spec.html) is available,
that represents the latest work of the group developing the specification.

General guidance for developers on what to consider to ensure security, that is currently maintained, is also available through the
[Smart Contract Security Verification Standard (SCSVS)](https://github.com/ComposableSecurity/SCSVS).

# Title

Unencrypted Private Data On-Chain
Expand Down Expand Up @@ -60,6 +72,18 @@ contract OddEven {
}
```

#### Comments

The vulnerable version above requires the players to send the number they are using
as part of the transaction.
This means the first player's number will be visible, allowing the second player to select a number
that they know will make them a winner.
(This assumption is simplistic to illustrate - there are also possibilities to front-run players,
among other potential issues).

In the fixed version below, the players instead submit a commitment that obfuscates their number,
and only subsequently reveal that they know the secret to set in train the process of a payout.

### odd_even_fixed.sol

```solidity
Expand Down

0 comments on commit 6d2f140

Please sign in to comment.