Several block operation validation functions can raise IndexError in addition to a ValidationError e.g. validate_voluntary_exit(), validate_proposer_slashing() when passed an Operation with an invalid validator index.
It is not obvious whether this is a documentation issue (that IndexErrors are an expected result), or a crash-causing bug and DOS vector:
What is wrong?
Several block operation validation functions can raise
IndexError
in addition to aValidationError
e.g.validate_voluntary_exit()
,validate_proposer_slashing()
when passed anOperation
with an invalid validator index.It is not obvious whether this is a documentation issue (that
IndexError
s are an expected result), or a crash-causing bug and DOS vector:IndexError
as an expected exception type: https://github.com/ethereum/trinity/blob/84381f4fe19b18dddf2d2b210bd0780038728acd/eth2/beacon/tools/fixtures/test_types/operations.py#L135-L146IndexError
s: https://github.com/ethereum/trinity/blob/84381f4fe19b18dddf2d2b210bd0780038728acd/trinity/sync/beacon/chain.py#L158How can it be fixed
Catch
IndexError
s immediately and wrap them with aValidationError
. This is clearer and avoids potential bugs from forgetting to catchIndexError
s.How it was found
Discovered via
beacon-fuzz
(initial testing ofproposer_slashing
fuzzer). Triggering case: proposer_slashing-crash-35a9d8e810ef1c20f057ee4e6aa8a927dc2ed6dc with the followingbeacon_state
s Or the pre-processed input propslash_preprocessed_indexerror.ssz can be directly passed to the trinity harness