How does the responder in the oracle know if he has already responded？

æpp Development
1

How does the responder in the oracle know if he has already responded？
After the query is made, the responder responds, but when the responder gets the data from the node, it has no way of knowing whether the question has been answered
I also looked for the API of the node and did not find this field

image
image3144×822 136 KB

2

Per query there can only be one response, so the responder can check if a query already has a response. The queries endpoint also includes the responses.

1 Like
3

So how does the responder check if it has been matched? By what?
The responder retrieves unresponded queries with /oracles/{pubkey}queries, but the interface continues to return data after the response

4

it continues to return data, but also returns the already answered query, so you can filter out those that already have an response attached

1 Like
5

There may be a problem
The interface has no paging data, and the data retention is dependent on the height of the setting. A persistent query attack against an existing oracle (polling requests all the time) can generate a lot of junk

1 Like
6

Imagine if an attacker made 10W requests to the data provider. It would be difficult for the data provider to retrieve the data, and it would be difficult for the data provider to find out which one had been answered

7

I think it would be better to make a distinction, add an answered and unanswered interface to the node, and add pagination

8

is this an actual issue you see? the chain prunes oracle data after the ttl has timed out, so I guess this will never be an issue.

9

lets not get stuck in change requests that are not an actual problem

1 Like
10

The TTL can be set very high and is also set by the querier. If set to 999999, this data will exist for more than a year. What if it’s higher?
Very few people use oracles these days, and if someone is already using them, it’s definitely an attack

11

fees rise with the ttl, so its draining the attackers funds, making it a non-viable attack

2 Likes
12

as an oracle operator and user you don’t have to use that endpoint, you can also listen to the chain and find queries that way

13

I will try the attack, if successful, I will reply to the post, see how much the attack cost should be, if the attack cost is very large, then this problem will not exist, thank you for your answer

2 Likes
14

please also check if listening to the chain mitigates potential issues using that endpoint

2 Likes
15

Okay, thank you