ethereum / trinity-eth2

The Trinity client for the Eth2 network
MIT License
13 stars 6 forks source link

Beacon operation validation can raise `IndexError`s #4

Open gnattishness opened 4 years ago

gnattishness commented 4 years ago

What is wrong?

Several block operation validation functions can raise IndexError in addition to a ValidationError e.g. validate_voluntary_exit(), validate_proposer_slashing() when passed an Operation with an invalid validator index.

It is not obvious whether this is a documentation issue (that IndexErrors are an expected result), or a crash-causing bug and DOS vector:

How can it be fixed

Catch IndexErrors immediately and wrap them with a ValidationError. This is clearer and avoids potential bugs from forgetting to catch IndexErrors.

How it was found

Discovered via beacon-fuzz (initial testing of proposer_slashing fuzzer). Triggering case: proposer_slashing-crash-35a9d8e810ef1c20f057ee4e6aa8a927dc2ed6dc with the following beacon_states Or the pre-processed input propslash_preprocessed_indexerror.ssz can be directly passed to the trinity harness

ChihChengLiang commented 4 years ago

Thank you @gnattishness for reporting this. Made a pull request to fix it. ethereum/trinity#1502

ChihChengLiang commented 4 years ago

Sorry I just saw ethereum/trinity#1498 🙈

ralexstokes commented 4 years ago

Refer this PR: https://github.com/ethereum/trinity/pull/1498