search

Grinnode-live / 2020-grin-bug-bash-challenge

Finding bugs in Grin-Wallet & Grin-nodes for a bounty prior to Grin fork v5.
3 stars 1 forks source link

[GRIN-Wallet][Foreign API] wrong foreign api password #12

Closed MCM-Mike closed 3 years ago

MCM-Mike commented 3 years ago

Description: Give the wallet the wrong foreign API password.

Prerequisites: Setup a Grin-Wallet.

Give the wallet the wrong foreign API password, run grin-wallet info. verify that the error includes the cause (authorization denied).

Expected result: It should fail. Expect the error message to not indicate that password is incorrect, instead it should report ResponseError error: Cannot parse response

Include the output of command

grin-wallet -V

and your environment

uname -a
goyle commented 3 years ago

Description

Give the wallet the wrong foreign API password.

Prerequisites

Setup a Grin-Wallet.

Give the wallet the wrong foreign API password, run grin-wallet info. verify that the error includes the cause (authorization denied).

Expected Result

It should fail. Expect the error message to not indicate that password is incorrect, instead it should report ResponseError error: Cannot parse response

Include the output of command

grin-wallet -V

and your environment

uname -a

Environment

OS: Debian 10\ Grin Wallet: grin-wallet 5.0.0-rc.1\ System Info: Linux debian2 4.19.0-13-amd64 #1 SMP Debian 4.19.160-2 (2020-11-28) x86_64 GNU/Linux

Steps

1: Building the Node and Wallet

See here for the full steps for building GRIN-Node v5.0.0-rc.1. 1. Download GRIN-Node v5.0.0-rc.1. ```shell $ wget https://github.com/mimblewimble/grin/archive/v5.0.0-rc.1.tar.gz ``` 1. Extract `v5.0.0-rc.1.tar.gz`. ```shell $ tar -xvf v5.0.0-rc.1.tar.gz ``` * Output should be as follows. ``` grin-5.0.0-rc.1/ grin-5.0.0-rc.1/.cargo/ grin-5.0.0-rc.1/.cargo/config grin-5.0.0-rc.1/.ci/ grin-5.0.0-rc.1/.ci/general-jobs grin-5.0.0-rc.1/.ci/release.yml grin-5.0.0-rc.1/.ci/test.yml grin-5.0.0-rc.1/.ci/windows-release.yml grin-5.0.0-rc.1/.editorconfig grin-5.0.0-rc.1/.github/ ... ``` 1. Install Rust. ```shell $ curl https://sh.rustup.rs -sSf | sh; source $HOME/.cargo/env ``` * Proceed with installation with default profile. ``` default host triple: x86_64-unknown-linux-gnu default toolchain: stable (default) profile: default modify PATH variable: yes ``` * Output should be as follows. ``` stable-x86_64-unknown-linux-gnu installed - rustc 1.48.0 (7eac88abb 2020-11-16) ``` 1. Download dependencies, including `libcursesw5`. ```shell # apt install build-essential git tor cmake git libgit2-dev clang libncursesw5 libncurses5-dev libncursesw5-dev zlib1g-dev pkg-config libssl-dev llvm ``` 1. Build GRIN-Node v5.0.0-rc.1. ```shell $ cd grin-5.0.0-rc.1/ $ cargo build --release ``` 1. Configure the node to save its logs and chain data in the current directory. This is optional and I did this for convenience and testing purposes. ``` $ cd target/release/ $ ./grin server config ``` * The output will be as follows. ``` grin-server.toml file configured and created in current directory ``` 1. If the previous step is done, enable DEBUG mode in `grin-server.toml`. ``` #log level for file: Error, Warning, Info, Debug, Trace file_log_level = "Debug" ``` 1. Start node. ``` $ ./grin ``` 1. Wait until Grin has fully synced. 1. Success!
See here for the full steps for building GRIN-Wallet v5.0.0-rc.1. 1. Download GRIN-Wallet v5.0.0-rc.1. ```shell $ wget https://github.com/mimblewimble/grin-wallet/archive/v5.0.0-rc.1.tar.gz ``` 1. Extract `v5.0.0-rc.1.tar.gz`. ```shell $ tar -xvf v5.0.0-rc.1.tar.gz ``` * Output should be as follows. ``` grin-wallet-5.0.0-rc.1/ grin-wallet-5.0.0-rc.1/.cargo/ grin-wallet-5.0.0-rc.1/.cargo/config grin-wallet-5.0.0-rc.1/.ci/ grin-wallet-5.0.0-rc.1/.ci/general-jobs grin-wallet-5.0.0-rc.1/.ci/release.yml grin-wallet-5.0.0-rc.1/.ci/test.yml grin-wallet-5.0.0-rc.1/.ci/windows-release.yml grin-wallet-5.0.0-rc.1/.github/ ... ``` 1. Install Rust. ```shell $ curl https://sh.rustup.rs -sSf | sh; source $HOME/.cargo/env ``` * Proceed with installation with default profile. ``` default host triple: x86_64-unknown-linux-gnu default toolchain: stable (default) profile: default modify PATH variable: yes ``` * Output should be as follows. ``` stable-x86_64-unknown-linux-gnu installed - rustc 1.48.0 (7eac88abb 2020-11-16) ``` 1. Download dependencies, including `libcursesw5`. ```shell # apt install build-essential git tor cmake git libgit2-dev clang libncursesw5 libncurses5-dev libncursesw5-dev zlib1g-dev pkg-config libssl-dev llvm ``` 1. Build GRIN-Wallet v5.0.0-rc.1. ```shell $ cd grin-wallet-5.0.0-rc.1/ $ cargo build --release ``` 1. Wait for the GRIN-Wallet to finish compiling and then check the wallet version. ```shell $ cd target/release $ ./grin-wallet -V ``` * The output should be as follows. ``` grin-wallet 5.0.0-rc.1 ``` 1. Success!

2: Initialize the Wallet

  1. Initialize a new GRIN-Wallet. 
    $ ./grin-wallet init
  2. Enter a password for your new wallet. Confirm the password. 
    Please enter a password for your new wallet
Password:

  3. A 24-word recovery phrase will appear that can be used to back-up the wallet. (An example recovery phrase is shown.)

    20201227 10:51:25.831 WARN grin_wallet_impls::lifecycle::seed - Generating wallet seed file at: /home/user2/.grin/main/wallet_data/wallet.seed
Your recovery phrase is:

wash swarm aerobic friend taxi unknown skin foil legal kick range win weasel bring neck unknown skin foil aerobic kick

Please back-up these words in a non-digital format.
Command 'init' completed successfully
  4. The wallet seed file will be created in ~/.grin/main/wallet_data/wallet.seed. The wallet configuration file will be in ~/.grin/main/grin-wallet.toml.

  5. While the GRIN-Node is running, check the basic wallet contents summary. Enter your password to continue.

    $ ./grin-wallet info

    • The output should appear similar to this.

      20201227 11:03:14.001 WARN grin_wallet_libwallet::api_impl::owner_updater - Scanning - 0% complete
20201227 11:03:14.026 WARN grin_wallet_libwallet::api_impl::owner_updater - Scanning - 99% complete
20201227 11:03:14.042 WARN grin_wallet_libwallet::api_impl::owner_updater - Scanning - 99% complete
20201227 11:03:14.043 WARN grin_wallet_libwallet::api_impl::owner_updater - Scanning Complete

____ Wallet Summary Info - Account 'default' as of height 1020371 ____

Confirmed Total                  | 0.000000000 
Awaiting Confirmation (< 10)     | 0.000000000 
Awaiting Finalization            | 0.000000000 
Locked by previous transaction   | 0.000000000 
-------------------------------- | ------------- 
Currently Spendable              | 0.000000000 

Command 'info' completed successfully

3: Test the Foreign API Secret

  1. The location of the GRIN-Node foreign API secret will be determined by node_api_secret_path in the grin-wallet.toml config file at the ~/.grin/main directory. grin-wallet.toml 
    node_api_secret_path = "/home/user2/.grin/main/.foreign_api_secret"
  2. Go to the directory where your foreign API secret is located and back it up. 
    $ cp .foreign_api_secret .foreign_api_secret_backup

  3. Edit your foreign API secret into a string of x's.

    .foreign_api_secret

    xxxxxxxxxxxxxxxxxxxx

  4. It's now time to test the wallet by giving it the wrong foreign API secret. While the GRIN-Node is running, check the basic wallet contents summary. Enter your password at the prompt.

    $ cd ~/grin-wallet-5.0.0-rc.1/target/release/
$ ./grin-wallet info

    • An unexpected output will appear.

      20201227 11:24:23.779 WARN grin_wallet_libwallet::api_impl::owner_updater - Scanning - 0% complete
20201227 11:24:23.799 WARN grin_wallet_libwallet::api_impl::owner_updater - Scanning - 99% complete
20201227 11:24:23.810 WARN grin_wallet_libwallet::api_impl::owner_updater - Scanning - 99% complete
20201227 11:24:23.811 WARN grin_wallet_libwallet::api_impl::owner_updater - Scanning Complete

____ Wallet Summary Info - Account 'default' as of height 1020388 ____

Confirmed Total                  | 0.000000000 
Awaiting Confirmation (< 10)     | 0.000000000 
Awaiting Finalization            | 0.000000000 
Locked by previous transaction   | 0.000000000 
-------------------------------- | ------------- 
Currently Spendable              | 0.000000000 

Command 'info' completed successfully

Errors

The actual output of ./grin-wallet info does not match with the expected error output after providing the wallet with the wrong foreign API secret.

marekyggdrasil commented 3 years ago

Thanks for checking @goyle I will attempt to reproduce this.

marekyggdrasil commented 3 years ago

@goyle I'm afraid this issue was not valid. The foreign API is not protected https://docs.rs/grin_wallet_api/4.0.0/grin_wallet_api/trait.ForeignRpc.html and it should not affect the performance of the wallet grin-wallet info. I think I have misunderstood the issue, terribly sorry for this, of course you will be rewarded for your test work regardless of that.

Maybe @MCM-Mike could elaborate what he meant in this test, in the current form I am not really sure. Your findings seems perfectly correct to me.