status-im / specs

Specifications for Status clients.
https://specs.status.im/
MIT License
14 stars 14 forks source link

Sec considerations for ENS Name resolution in mentions #144

Open 0kok0 opened 4 years ago

0kok0 commented 4 years ago

During the Core Dev Call 32 it was brought up the possibility to maliciously trigger rpc calls to the eth node when @mentions are resolved from the ENS. Potentially this can be abused if the lookup is not cashed and bounded, for example for DOS amplification on the eth node or to trigger node blacklisting on infuras end.