<p>Yes, he could, if he had more than 1 million ADA to give away for free.
Each UTxO must have a minimum amount of ADA attached to it. If the attacker creates 1 million UTxOs at the smart contract address, he loses the 1.x ADA attached to each UTxO. That ADA might be lost forever or it might be possible for the smart contract creator to recover it by spending the UTxOs (depending on how the contract was written and on how the UTxOs were created).
So the attack could work, but it will be very expensive.</p>

CC BY-SA 4.0
2024-09-27T06:48:59.747Z
2024-09-27T06:48:59.747Z
George - APEX Stake Pool
<p>Cardano n00b here. I'm currently working through the oracle example from the Plutus Pioneer Program.</p>
<p>In the section on updating the oracle, there is a function <code>findOracle</code> that loops through all UTXOs sent to the oracle's address, and looks for one that has the NFT we are interested in.</p>
<p><a href="https://plutus-pioneer-program.readthedocs.io/en/latest/pioneer/week6.html#updating-the-oracle" rel="nofollow noreferrer">https://plutus-pioneer-program.readthedocs.io/en/latest/pioneer/week6.html#updating-the-oracle</a></p>
<p>Couldn't an attacker create a million UTXOs at that same address, thereby causing our code here to take too long?</p>
<p>Thanks in advance.</p>

<plutus-pioneer-program>
DoS attacking oracle NFT?
# DoS attacking oracle NFT?

(Asked by: username_0 on 2024-09-26)

Cardano n00b here. I'm currently working through the oracle example from the Plutus Pioneer Program.

In the section on updating the oracle, there is a function `findOracle` that loops through all UTXOs sent to the oracle's address, and looks for one that has the NFT we are interested in.

<https://plutus-pioneer-program.readthedocs.io/en/latest/pioneer/week6.html#updating-the-oracle>

Couldn't an attacker create a million UTXOs at that same address, thereby causing our code here to take too long?

Thanks in advance.

**Tags:** plutus-pioneer-program

---

## 1 answers

### Answer by username_1 on 2024-09-27. Score: 0

Yes, he could, if he had more than 1 million ADA to give away for free.
Each UTxO must have a minimum amount of ADA attached to it. If the attacker creates 1 million UTxOs at the smart contract address, he loses the 1.x ADA attached to each UTxO. That ADA might be lost forever or it might be possible for the smart contract creator to recover it by spending the UTxOs (depending on how the contract was written and on how the UTxOs were created).
So the attack could work, but it will be very expensive.


---

