DoS attacking oracle NFT?

Question

Cardano n00b here. I'm currently working through the oracle example from the Plutus Pioneer Program.

In the section on updating the oracle, there is a function findOracle that loops through all UTXOs sent to the oracle's address, and looks for one that has the NFT we are interested in.

https://plutus-pioneer-program.readthedocs.io/en/latest/pioneer/week6.html#updating-the-oracle

Couldn't an attacker create a million UTXOs at that same address, thereby causing our code here to take too long?

Thanks in advance.

Answer 1

Yes, he could, if he had more than 1 million ADA to give away for free. Each UTxO must have a minimum amount of ADA attached to it. If the attacker creates 1 million UTxOs at the smart contract address, he loses the 1.x ADA attached to each UTxO. That ADA might be lost forever or it might be possible for the smart contract creator to recover it by spending the UTxOs (depending on how the contract was written and on how the UTxOs were created). So the attack could work, but it will be very expensive.