<p>Yes, if you had the script CBOR before, you could have used it to extract the seed and hack the challenge.</p>
<p>With aiken, which at this time was probably not available, you can do:</p>
<pre><code>echo &quot;591021010000332323233223...12330010030021120011&quot; &gt; lobster.cbor
aiken uplc unflat lobster.cbor -c
grep &quot;con integer&quot; lobster.uplc
</code></pre>
<p>and get the result:</p>
<pre><code>                            [ i_930 (con integer 582757474857012117487873) ]
                      (con integer 1219)
                    (con integer 500)
</code></pre>
<p>and identify the 500 as the number of votes (known), the 1219 as the number of names (known) leaving only the 582757474857012117487873 as the secret number.</p>

CC BY-SA 4.0
2023-04-11T06:58:02.163Z
Thanks! Although surely the participants would have needed to supply the script CBOR to the validator when submitting their transactions?
zing
CC BY-SA 4.0
2023-04-12T07:35:53.890Z
Yes, true, it was the same contract to reveal and to vote. 
I remembered it as two different contracts, in this case it would have been safe.
I'll add how one can find the constants from the cbor to the answer.
DaveStrider
CC BY-SA 4.0
2023-04-12T08:56:30.493Z
Cool, thanks for clarification. Also great addition to the answer!
zing
CC BY-SA 4.0
2023-04-10T14:15:28.297Z
2023-04-12T07:45:23.590Z
2023-04-12T07:45:23.590Z
DaveStrider
<p>Since script params are compiled into the validator, this means that if you have the script cbor you can see what the param value is, right? Hence they would not be suitable to store data you don't want available on chain?</p>
<h5>context</h5>
<p>The reason I'm asking is because I had a look at the lobster challenge (<a href="https://github.com/input-output-hk/lobster-challenge" rel="nofollow noreferrer">https://github.com/input-output-hk/lobster-challenge</a>) posted by iohk a while back and they mentioned that they used a script parameter to add their &quot;secret random&quot; number when the contract was compiled, which would be used to offset the final value.</p>
<p>My intuition says if you had access to the script cbor(which you can get from blockfrost now) you would have been able to find out what their number was and if you were the last voter, have your pick of the name? Them using this method made me question whether having the cbor is enough - I'm not familiar with what's involved in decompiling plutus core cbor.
Thanks.</p>
<blockquote>
<p>As you can imagine I'm not too fussed about whether the lobster naming was exploitable, more curious for the sake of learning.</p>
</blockquote>

<validator>
Are validator script parameters secure? (lobster challenge)
# Are validator script parameters secure? (lobster challenge)

(Asked by: username_0 on 2023-04-10)

Since script params are compiled into the validator, this means that if you have the script cbor you can see what the param value is, right? Hence they would not be suitable to store data you don't want available on chain?

##### context

The reason I'm asking is because I had a look at the lobster challenge (<https://github.com/input-output-hk/lobster-challenge>) posted by iohk a while back and they mentioned that they used a script parameter to add their "secret random" number when the contract was compiled, which would be used to offset the final value.

My intuition says if you had access to the script cbor(which you can get from blockfrost now) you would have been able to find out what their number was and if you were the last voter, have your pick of the name? Them using this method made me question whether having the cbor is enough - I'm not familiar with what's involved in decompiling plutus core cbor.
Thanks.

> As you can imagine I'm not too fussed about whether the lobster naming was exploitable, more curious for the sake of learning.

**Tags:** validator

---

## 1 answers

### Answer by username_1 on 2023-04-10. Score: 1 | Accepted answer

Yes, if you had the script CBOR before, you could have used it to extract the seed and hack the challenge.
With aiken, which at this time was probably not available, you can do:
echo "591021010000332323233223...12330010030021120011" > lobster.cbor
aiken uplc unflat lobster.cbor -c
grep "con integer" lobster.uplc

and get the result:
                            [ i_930 (con integer 582757474857012117487873) ]
                      (con integer 1219)
                    (con integer 500)

and identify the 500 as the number of votes (known), the 1219 as the number of names (known) leaving only the 582757474857012117487873 as the secret number.

> **Comments:**
> **username_0**: Thanks! Although surely the participants would have needed to supply the script CBOR to the validator when submitting their transactions?  
> **username_1**: Yes, true, it was the same contract to reveal and to vote.  I remembered it as two different contracts, in this case it would have been safe. I'll add how one can find the constants from the cbor to the answer.  
> **username_0**: Cool, thanks for clarification. Also great addition to the answer!  

---

