We've patched our front-end to fix an exploit used to make a question display misleading, which was actively exploited in the wild for a single question now pending arbitration.
If you maintain an app using the JavaScript library reality-eth-lib, please update to v3.4.33
There was a bug in our reality-eth-lib javascript library which someone has been exploiting as reported here.
This affects web pages that use the library to show reality.eth questions.
🚨 Defimon detected a stored XSS via governance proposal text on @RealityEth dApp.
The payload poisons app-global localStorage with attacker controlled RPC URLs, hooks window.ethereum.request and rewrites the answer. Curators, arbitrators or keepers answering any live question get silently flipped to "yes" on attacker-fed data enabling forced execution of malicious module transactions.
A fresh EOA used the permissionless addProposal() on Potion DAO's abandoned Zodiac Reality Module purely as an injection vector: the module asks its question on the shared reality.eth oracle, so it lands in the global question index.
The proposal's question JSON supplies title_html directly with an
payload. reality.eth's DOMPurify only sanitizes the markdown path. Direct title_html is trusted verbatim and rendered via jQuery .html('.question-title'). It fires for any reality.eth visitor whose feed includes this entry.
Malicious question: reality.gwei.site/#!/network… (do not open with a wallet)
TX: etherscan.io/tx/0x95932a1d8b…
Attacker: etherscan.io/address/0xd57a4…
The old version of the dapp also contained the bug but it was probably harder to exploit. We've patched both the old front-end and our current site at reality.eth. Please make sure to do a full browser refresh so you don't keep using insecure version from the browser cache.
We're reverting to our old UI while we investigate this.
🚨 Defimon detected a stored XSS via governance proposal text on @RealityEth dApp.
The payload poisons app-global localStorage with attacker controlled RPC URLs, hooks window.ethereum.request and rewrites the answer. Curators, arbitrators or keepers answering any live question get silently flipped to "yes" on attacker-fed data enabling forced execution of malicious module transactions.
A fresh EOA used the permissionless addProposal() on Potion DAO's abandoned Zodiac Reality Module purely as an injection vector: the module asks its question on the shared reality.eth oracle, so it lands in the global question index.
The proposal's question JSON supplies title_html directly with an
payload. reality.eth's DOMPurify only sanitizes the markdown path. Direct title_html is trusted verbatim and rendered via jQuery .html('.question-title'). It fires for any reality.eth visitor whose feed includes this entry.
Malicious question: reality.gwei.site/#!/network… (do not open with a wallet)
TX: etherscan.io/tx/0x95932a1d8b…
Attacker: etherscan.io/address/0xd57a4…
reality.eth retweeted
I think that with Kleros Safe Snap, we may have inadvertently created a honeypot for hackers. People keep submitting drain attempts and those keep being challenged by honest reporters.
Here the hacker just lost 2 ETH (5.4k$) to the honest reporter. @Kleros_io @ShutterNetwork
reality.eth retweeted
Agents are trading on prediction markets.
Since 2023, ~3,600 AI agents running on @autonolas have placed $390k+ in bets on Omen prediction markets, with Kleros as the arbitrator.
Along the way, Olas distributed ~$1.7M in OLAS rewards to these agents (valued at payout).
Autonomous agents, trading on markets secured by decentralized justice.
reality.eth retweeted
Both markets are open until Sunday:
Attendance, how many would come: devcon-attendance.foresight.…
Satisfaction, how they would rate it: devcon-satisfaction.foresigh…
Trading on @gnosischain, results posted on @RealityEth, and Kleros Court has the final word if anyone disputes them.
reality.eth retweeted
How it works, in full:
xitter.cf/Kleros_io/status/20973…
🎉 Pick Our Party: @seer_pm and Kleros are letting decision markets choose their @EFDevcon Mumbai side event
Seer and Kleros will host one side event together at DevCon Mumbai this November. We are not choosing which one. Two prediction markets are, and you can trade them now.
Seven candidate events are listed. Only one of them happens.
🎳 Arcade / Bowling Night
🌀 Marble Race Game, where the crowd votes on the track
🕵️ Murder Mystery Game, a case you trade on
🍽️ Networking Dinner, curated and seaside
🛺 Tuk-Tuk Street Food & Cocktail Night in Bandra
🏎️ Go-Karting
🎤 The Last Mile of a Prediction Market, a half-day on the topic
Every candidate has an attendance market (if held, how many guests come?) and a satisfaction market (if held, how do the guests rate it, 0 to 10?). The two forecasts combine into a Selection Score. Highest score wins, and that is the party we throw.
Then the guests settle it. In Mumbai, check-ins count the room and a four-question survey scores the night. Those two numbers resolve the markets, so the traders who priced the winner right get paid.
The markets run on Foresight, Kleros' prediction market interface built on Seer, on @gnosischain. Results are posted on @RealityEth and Kleros Court has the final word if anyone disputes them.
Seer builds the markets. Kleros resolves the disputes. Both of us are handing the decision to you.
Trade until Sunday 13 September, 12:00 UTC. Links and the full guide in the next post.
This is now live at reality.eth.link
The old version is at old.reality.eth.link in case you run into some bug with the new one that prevents you disputing a bad answer
Our new front-end is up at
reality.gwei.site/
We'll update the reality.eth site to match in the next week or two.
The old version will stay up at old.reality.eth.link
until we're totally confident there aren't any bugs that might prevent people disputing bad answers.
We hear that the eth.limo domain has been compromised. Please don't use reality.eth through the .eth.limo gateway until we hear it's safe.
We're still trying to find out whether .eth.link is safe to use, but in the meantime we keep a backup of the dapp at
realityeth.github.io
You can also load it directly via ipfs.
reality.eth retweeted
We hear that the eth.limo domain has been compromised. Please don't use reality.eth through the .eth.limo gateway until we hear it's safe.
reality.eth retweeted
our domaim appears to have been compromised and the eth.limo domain has been hijacked. We're actively working with all parties involved to assess the situation and remediate the problem.
reality.eth retweeted
The kind people at @eth_limo have warned me that there has been an attack on their DNS registrar. So please do not visit vitalik.eth.limo or other eth.limo pages until they confirm that things are back to normal.
You can check my blog via IPFS directly here: bafybeiaql2jo3fu5b7c4lmpoi5d…
Our UI is temporarily showing old data for mainnet when loading using The Graph. This should fix itself in an hour or so when the subgraph finishes resyncing. Use RPC mode to get current data.
reality.eth retweeted
🚀 The @Kleros_io audit competition is officially live!
Before submitting, please review the open issues here:
🔗 github.com/hats-finance/Cros…
Good luck to all participants; it's time to showcase your skills!












