dusk-network / rusk

The reference Dusk platform implementation and tools
Mozilla Public License 2.0
157 stars 59 forks source link

Missing validations #2125

Closed HDauven closed 1 week ago

HDauven commented 1 month ago

Summary

  1. In node/src/network/frame.rs:25, field checksum is declared. It is initialized on line 35, but it is never utilized to verify a header consistency.
  2. In node-data/src/ledger/attestation.rs:35, the structure StepVotes is considered to be empty if any of bitset or aggregate_signature is zero. However, if only one of these fields is zero then it must be treated as an inconsistent structure.
  3. In node/src/databroker.rs:303, a child block was added to the inventory. This is part of the traversal from one block specified by its hash through all of its descendants. To ensure consistency of the database, the value of prev_block_hash of each child pair should be checked against the hash of its parent.
  4. Within consensus/src/user/provisioners.rs:255-263, edge case of a single active provisioner is handled. Set members should be checked to be non-empty in the end. It can be useful to double-check that exclusion set is equal to eligibles set in this edge case.
  5. In node-data/src/ledger.rs:38, the function to_str returns an error because the length of the hexadecimal string is not even. However, the function hex::encode called on line 36 always returns even strings.

Solution

We recommend adding validation checks and utilizing debug_assert! for invariants checks.

goshawk-3 commented 1 month ago

In node/src/network/frame.rs:25, field checksum is declared. It is initialized on line 35, but it is never utilized to verify a header consistency.

Resolved in https://github.com/dusk-network/rusk/pull/2091/commits/16e18ae75b9120b1eeb533b2ba5fd1a4dd05cc05

In node-data/src/ledger.rs:38, the function to_str returns an error because the length of the hexadecimal string is not even. However, the function hex::encode called on line 36 always returns even strings.

Resolved in https://github.com/dusk-network/rusk/pull/2088

autholykos commented 1 week ago

@goshawk-3 can you please merge #2157 so we can close this one?