You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Several block operation validation functions can raise IndexError in addition to a ValidationError e.g. validate_voluntary_exit(), validate_proposer_slashing() when passed an Operation with an invalid validator index.
It is not obvious whether this is a documentation issue (that IndexErrors are an expected result), or a crash-causing bug and DOS vector:
What is wrong?
Several block operation validation functions can raise
IndexError
in addition to aValidationError
e.g.validate_voluntary_exit()
,validate_proposer_slashing()
when passed anOperation
with an invalid validator index.It is not obvious whether this is a documentation issue (that
IndexError
s are an expected result), or a crash-causing bug and DOS vector:IndexError
as an expected exception type: https://github.com/ethereum/trinity/blob/84381f4fe19b18dddf2d2b210bd0780038728acd/eth2/beacon/tools/fixtures/test_types/operations.py#L135-L146IndexError
s: https://github.com/ethereum/trinity/blob/84381f4fe19b18dddf2d2b210bd0780038728acd/trinity/sync/beacon/chain.py#L158How can it be fixed
Catch
IndexError
s immediately and wrap them with aValidationError
. This is clearer and avoids potential bugs from forgetting to catchIndexError
s.How it was found
Discovered via
beacon-fuzz
(initial testing ofproposer_slashing
fuzzer).Triggering case: proposer_slashing-crash-35a9d8e810ef1c20f057ee4e6aa8a927dc2ed6dc with the following
beacon_state
sOr the pre-processed input propslash_preprocessed_indexerror.ssz can be directly passed to the trinity harness
The text was updated successfully, but these errors were encountered: