search

hyperledger / fabric-sdk-go

https://wiki.hyperledger.org/display/fabric
Apache License 2.0
910 stars 510 forks source link

Potential Privacy leakage in the "move" function in example_cc.go #290

Open pdchecker opened 1 month ago

pdchecker commented 1 month ago

The "move" fuunction in test/fixtures/testdata/go/src/github.com/example_cc/example_cc.go returns "transientData" in line 240, which is obtained from "GetTransient" in line 238. Since transient data is local to the peer and is private to other peers, there are two issues about this design:

  1. if transientData is private, the functions that query private data should be read-only, but "move" updates the world state.
  2. the transient data is local to the peer and will be exculded to the transaction, so how can other peers verify the "transientData"?