Since script params are compiled into the validator, this means that if you have the script cbor you can see what the param value is, right? Hence they would not be suitable to store data you don't want available on chain?


The reason I'm asking is because I had a look at the lobster challenge (https://github.com/input-output-hk/lobster-challenge) posted by iohk a while back and they mentioned that they used a script parameter to add their "secret random" number when the contract was compiled, which would be used to offset the final value.

My intuition says if you had access to the script cbor(which you can get from blockfrost now) you would have been able to find out what their number was and if you were the last voter, have your pick of the name? Them using this method made me question whether having the cbor is enough - I'm not familiar with what's involved in decompiling plutus core cbor. Thanks.

As you can imagine I'm not too fussed about whether the lobster naming was exploitable, more curious for the sake of learning.

1 Answer 1


Yes, if you had the script CBOR before, you could have used it to extract the seed and hack the challenge.

With aiken, which at this time was probably not available, you can do:

echo "591021010000332323233223...12330010030021120011" > lobster.cbor
aiken uplc unflat lobster.cbor -c
grep "con integer" lobster.uplc

and get the result:

                            [ i_930 (con integer 582757474857012117487873) ]
                      (con integer 1219)
                    (con integer 500)

and identify the 500 as the number of votes (known), the 1219 as the number of names (known) leaving only the 582757474857012117487873 as the secret number.

  • Thanks! Although surely the participants would have needed to supply the script CBOR to the validator when submitting their transactions?
    – zing
    Apr 11, 2023 at 6:58
  • Yes, true, it was the same contract to reveal and to vote. I remembered it as two different contracts, in this case it would have been safe. I'll add how one can find the constants from the cbor to the answer. Apr 12, 2023 at 7:35
  • Cool, thanks for clarification. Also great addition to the answer!
    – zing
    Apr 12, 2023 at 8:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.