FuelLabs / fuel-vm

Fuel v2 interpreter in Rust
Other
358 stars 88 forks source link

Predicate estimation is, almost, unbounded #756

Closed xgreenx closed 5 months ago

xgreenx commented 5 months ago

The predicate estimation allows MAX_GAS_PER_TRANSACTION for each predicate in the transaction.

image

Currently, we allow 255 inputs per transaction. It allows the attacker to consume a lot of resources during the estimation of the predicate by submitting transactions with 255 predicates that are using 30M gas each, which can lead to 85 seconds of execution.