Crowd-sourced verification for smart contracts. Formerly Realitio.

Made in Japan
Joined October 2013
We've patched our front-end to fix an exploit used to make a question display misleading, which was actively exploited in the wild for a single question now pending arbitration. If you maintain an app using the JavaScript library reality-eth-lib, please update to v3.4.33
107
There was a bug in our reality-eth-lib javascript library which someone has been exploiting as reported here. This affects web pages that use the library to show reality.eth questions.
🚨 Defimon detected a stored XSS via governance proposal text on @RealityEth dApp. The payload poisons app-global localStorage with attacker controlled RPC URLs, hooks window.ethereum.request and rewrites the answer. Curators, arbitrators or keepers answering any live question get silently flipped to "yes" on attacker-fed data enabling forced execution of malicious module transactions. A fresh EOA used the permissionless addProposal() on Potion DAO's abandoned Zodiac Reality Module purely as an injection vector: the module asks its question on the shared reality.eth oracle, so it lands in the global question index. The proposal's question JSON supplies title_html directly with an payload. reality.eth's DOMPurify only sanitizes the markdown path. Direct title_html is trusted verbatim and rendered via jQuery .html('.question-title'). It fires for any reality.eth visitor whose feed includes this entry. Malicious question: reality.gwei.site/#!/network… (do not open with a wallet) TX: etherscan.io/tx/0x95932a1d8b… Attacker: etherscan.io/address/0xd57a4…
1
4
380
The old version of the dapp also contained the bug but it was probably harder to exploit. We've patched both the old front-end and our current site at reality.eth. Please make sure to do a full browser refresh so you don't keep using insecure version from the browser cache.
1
75
As an attacker may have written hostile settings to browser local storage, our new version will wipe any existing settings for indexer, RPC node etc. If you want to change those you'll need to set them again. We'll publish another update once we've done some more investigation.
1
58
We're reverting to our old UI while we investigate this.
🚨 Defimon detected a stored XSS via governance proposal text on @RealityEth dApp. The payload poisons app-global localStorage with attacker controlled RPC URLs, hooks window.ethereum.request and rewrites the answer. Curators, arbitrators or keepers answering any live question get silently flipped to "yes" on attacker-fed data enabling forced execution of malicious module transactions. A fresh EOA used the permissionless addProposal() on Potion DAO's abandoned Zodiac Reality Module purely as an injection vector: the module asks its question on the shared reality.eth oracle, so it lands in the global question index. The proposal's question JSON supplies title_html directly with an payload. reality.eth's DOMPurify only sanitizes the markdown path. Direct title_html is trusted verbatim and rendered via jQuery .html('.question-title'). It fires for any reality.eth visitor whose feed includes this entry. Malicious question: reality.gwei.site/#!/network… (do not open with a wallet) TX: etherscan.io/tx/0x95932a1d8b… Attacker: etherscan.io/address/0xd57a4…
1
2
3
341
reality.eth retweeted
I think that with Kleros Safe Snap, we may have inadvertently created a honeypot for hackers. People keep submitting drain attempts and those keep being challenged by honest reporters. Here the hacker just lost 2 ETH (5.4k$) to the honest reporter. @Kleros_io @ShutterNetwork
3
6
2
25
7,398
reality.eth retweeted
Agents are trading on prediction markets. Since 2023, ~3,600 AI agents running on @autonolas have placed $390k+ in bets on Omen prediction markets, with Kleros as the arbitrator. Along the way, Olas distributed ~$1.7M in OLAS rewards to these agents (valued at payout). Autonomous agents, trading on markets secured by decentralized justice.
1
5
4
27
4,951
reality.eth retweeted
Both markets are open until Sunday: Attendance, how many would come: devcon-attendance.foresight.… Satisfaction, how they would rate it: devcon-satisfaction.foresigh… Trading on @gnosischain, results posted on @RealityEth, and Kleros Court has the final word if anyone disputes them.
1
1
1
189
reality.eth retweeted
🎉 Pick Our Party: @seer_pm and Kleros are letting decision markets choose their @EFDevcon Mumbai side event Seer and Kleros will host one side event together at DevCon Mumbai this November. We are not choosing which one. Two prediction markets are, and you can trade them now. Seven candidate events are listed. Only one of them happens. 🎳 Arcade / Bowling Night 🌀 Marble Race Game, where the crowd votes on the track 🕵️ Murder Mystery Game, a case you trade on 🍽️ Networking Dinner, curated and seaside 🛺 Tuk-Tuk Street Food & Cocktail Night in Bandra 🏎️ Go-Karting 🎤 The Last Mile of a Prediction Market, a half-day on the topic Every candidate has an attendance market (if held, how many guests come?) and a satisfaction market (if held, how do the guests rate it, 0 to 10?). The two forecasts combine into a Selection Score. Highest score wins, and that is the party we throw. Then the guests settle it. In Mumbai, check-ins count the room and a four-question survey scores the night. Those two numbers resolve the markets, so the traders who priced the winner right get paid. The markets run on Foresight, Kleros' prediction market interface built on Seer, on @gnosischain. Results are posted on @RealityEth and Kleros Court has the final word if anyone disputes them. Seer builds the markets. Kleros resolves the disputes. Both of us are handing the decision to you. Trade until Sunday 13 September, 12:00 UTC. Links and the full guide in the next post.
1
2
240
This is now live at reality.eth.link The old version is at old.reality.eth.link in case you run into some bug with the new one that prevents you disputing a bad answer
FYI: reality(dot)eth, the oracle / bond protocol, now has a new UI it's a lot more user friendly than before
1
1
6
395
Our new front-end is up at reality.gwei.site/ We'll update the reality.eth site to match in the next week or two. The old version will stay up at old.reality.eth.link until we're totally confident there aren't any bugs that might prevent people disputing bad answers.
1
7
1,032
We hear that the eth.limo domain has been compromised. Please don't use reality.eth through the .eth.limo gateway until we hear it's safe.
1
1
1
265
We're still trying to find out whether .eth.link is safe to use, but in the meantime we keep a backup of the dapp at realityeth.github.io You can also load it directly via ipfs.
1
1
226
reality.eth retweeted
We hear that the eth.limo domain has been compromised. Please don't use reality.eth through the .eth.limo gateway until we hear it's safe.
1
1
1
265
reality.eth retweeted
our domaim appears to have been compromised and the eth.limo domain has been hijacked. We're actively working with all parties involved to assess the situation and remediate the problem.
14
75
32
236
56,888
reality.eth retweeted
The kind people at @eth_limo have warned me that there has been an attack on their DNS registrar. So please do not visit vitalik.eth.limo or other eth.limo pages until they confirm that things are back to normal. You can check my blog via IPFS directly here: bafybeiaql2jo3fu5b7c4lmpoi5d…
268
207
43
1,008
388,265
Our UI is temporarily showing old data for mainnet when loading using The Graph. This should fix itself in an hour or so when the subgraph finishes resyncing. Use RPC mode to get current data.
1
1
254
Should all be up-to-date now.
1
89
🚀 The @Kleros_io audit competition is officially live! Before submitting, please review the open issues here: 🔗 github.com/hats-finance/Cros… Good luck to all participants; it's time to showcase your skills!
9
3
1
23
4,495