Ecosystem/serai
Ecosystem/serai
1
0
Fork 0
mirror of https://github.com/serai-dex/serai.git synced 2024-11-16 17:07:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Document TOCTOU allowing malicious validator set to trigger a handover to an honest set

Browse source
This commit is contained in:
Luke Parker 2023-10-13 04:14:36 -04:00
parent 02edfd2935
commit e6aa9df428
No known key found for this signature in database
1 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
coordinator/src/main.rs
View file

@ -924,6 +924,15 @@ async fn handle_processor_messages<D: Db, Pro: Processors, P: P2p>(
MainDb::<D>::set_did_handover(&mut txn, spec.set());
}
// TODO: There is a race condition here. We may verify all `Batch`s from the prior
// set, start signing the handover Batch `n`, start signing `n+1`, have `n+1`
// signed before `n` (or at the same time), yet then the prior set forges a
// malicious Batch `n`.
//
// The malicious Batch `n` would be publishable to Serai, as Serai can't
// distinguish what's intended to be a handover `Batch`, yet then anyone could
// publish the new set's `n+1`, causing their acceptance of the handover.
Some(Transaction::Batch(block.0, id.id))
} else {
Some(Transaction::BatchPreprocess(SignData {