Open ghost opened 4 years ago
Hi
Thanks for your submission. We have tested the issue you mentioned and did reproduce it. This is a valid vulnerability. After evaluation, this vulnerability has been graded as P3. Please pay attention to the announcement and your email to get your rewards. Thanks for your attention and contribution. Please keep trying and help us improve our chain.
Regards KuChain Team
Describe The Bug In distribution module, delegator's withdraw Account can be empty when the event like unbonding or redelegation happen, rewarding coins will be burn.
In other words, Adversary can burn coins by a malicious transaction without the signature of coin's creator.
Code Snippets validateBasic of
setWithdrawAccount
hasn't be implemented. malicious transactions with empty withdrawAccount will be preformed normally.setWithdrawAccount structs look like this
Input/Output
input command line like this:
./build/ktscli tx kudistribution set-withdraw kratos --keyring-backend test --chain-id testing --home ./testing/cli/ --from kratos
output a normally successful response
To Reproduce
func GetCmdSetWithdrawAddr(cdc *codec.Codec) *cobra.Command {
in x/distribution/client/cli.go modifycobra.ExactArgs(2)
intocobra.ExactArgs(1)
modifywithdrawAccId, err := chainType.NewAccountIDFromStr(args[0])
intowithdrawAccId, err := chainType.NewAccountIDFromStr("")
2.remake ktscli
3.run command like this![image](https://user-images.githubusercontent.com/29042336/89025057-c3931300-d358-11ea-9f60-7748a5dfc66a.png)
./build/ktscli tx kudistribution set-withdraw kratos --keyring-backend test --chain-id testing --home ./testing/cli/ --from kratos
and we can see the normal response../build/ktscli query kudistribution whithdraw-addr kratos
as above, we set the withdrawAddr to empty.
Expected Behavior kratos need intact ValidateBasic function which be called in the AnteHandler for distribution module
Desktop
Additional Context the difference between issue#14 to issue#15 is that there wasn't any implementation of ValidateBasic for distribution in issue#15 at all.
Contact Information congfei.li@chaitin.com