drs version check fix

x/rollapp/keeper/msg_server_update_state.go

@@ -34,7 +34,15 @@ func (k msgServer) UpdateState(goCtx context.Context, msg *types.MsgUpdateState)
 		return nil, errorsmod.Wrap(err, "before update state")
 	}
 
-	for _, bd := range msg.BDs.BD {
+	// We only check first and last BD to avoid DoS attack related to iterating big number of BDs (taking into account a state update can be submitted with any numblock value)
+	// It is assumed there cannot be two upgrades in the same state update (since it requires gov proposal), if this happens it will be a fraud caught by Rollapp validators.
+	// Therefore checking first and last BD for deprecated DRS version should be enough.
+	var bdsToCheck []*types.BlockDescriptor
+	bdsToCheck = append(bdsToCheck, &msg.BDs.BD[0])
+	if msg.NumBlocks > 1 {
+		bdsToCheck = append(bdsToCheck, &msg.BDs.BD[len(msg.BDs.BD)-1])
+	}
+	for _, bd := range bdsToCheck {
 		// verify the DRS version is not vulnerable
 		if k.IsDRSVersionVulnerable(ctx, bd.DrsVersion) {
 			// the rollapp is not marked as vulnerable yet, mark it now

x/rollapp/types/errors.go

@@ -55,4 +55,5 @@ var (
 	ErrDisputeAlreadyReverted  = errorsmod.Register(ModuleName, 2001, "disputed height already reverted")
 	ErrWrongClientId           = errorsmod.Register(ModuleName, 2002, "client id does not match the rollapp")
 	ErrWrongProposerAddr       = errorsmod.Register(ModuleName, 2003, "wrong proposer address")
+	ErrInvalidDRSVersion       = errorsmod.Register(ModuleName, 2004, "wrong DRS version")
 )

x/rollapp/types/message_update_state.go

@@ -7,7 +7,10 @@ import (
 	sdk "github.com/cosmos/cosmos-sdk/types"
 )
 
-const TypeMsgUpdateState = "update_state"
+const (
+	TypeMsgUpdateState = "update_state"
+	DRSVersionLength   = 40
+)
 
 var _ sdk.Msg = &MsgUpdateState{}
 
@@ -68,11 +71,14 @@ func (msg *MsgUpdateState) ValidateBasic() error {
 		return errorsmod.Wrapf(ErrWrongBlockHeight, "StartHeight must be greater than zero")
 	}
 
-	// TODO: add a validation for DrsVersion once empty DRS version is marked vulnerable
-	//  https://github.com/dymensionxyz/dymension/issues/1233
-
 	// check that the blocks are sequential by height
 	for bdIndex := uint64(0); bdIndex < msg.NumBlocks; bdIndex += 1 {
+
+		// TODO: by now DRS version can be empty, but it will be deprecated
+		//  https://github.com/dymensionxyz/dymension/issues/1233
+		if msg.BDs.BD[bdIndex].DrsVersion != "" && len(msg.BDs.BD[bdIndex].DrsVersion) != DRSVersionLength {
+			return ErrInvalidDRSVersion
+		}
 		if msg.BDs.BD[bdIndex].Height != msg.StartHeight+bdIndex {
 			return ErrInvalidBlockSequence
 		}