Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Possible attack vector in multiple Msgs in a Tx #589

Open
kimurayu45z opened this issue Nov 19, 2024 · 0 comments
Open

Possible attack vector in multiple Msgs in a Tx #589

kimurayu45z opened this issue Nov 19, 2024 · 0 comments

Comments

@kimurayu45z
Copy link

https://github.com/skip-mev/block-sdk/blob/v2.1.5/lanes/free/lane.go#L41

func DefaultMatchHandler() base.MatchHandler {
	return func(_ sdk.Context, tx sdk.Tx) bool {
		for _, msg := range tx.GetMsgs() {
			switch msg.(type) {
			case *types.MsgDelegate:
				return true
			case *types.MsgBeginRedelegate:
				return true
			case *types.MsgCancelUnbondingDelegation:
				return true
			}
		}

		return false
	}
}

This match handler of Free lane regards as matching when at least one of Msgs listed above is contained in the Tx.
In this case, by inserting very heavy Msg after MsgDelegate, can't we consider an attack vector?

To solve this problem, the match handler should be like this:

func DefaultMatchHandler() base.MatchHandler {
	return func(_ sdk.Context, tx sdk.Tx) bool {
		for _, msg := range tx.GetMsgs() {
			switch msg.(type) {
			case *types.MsgDelegate:
				continue
			case *types.MsgBeginRedelegate:
				continue
			case *types.MsgCancelUnbondingDelegation:
				continue
			}
                        return false
		}

		return true
	}
}

In this match handler, Free lane accept only Txs which all Msgs are white listed (not at least one of).

If this issue get agreed, I will create a Pull Request.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant