Commits on Mar 10, 2023

1. import original iavl proof_forgery_test.go 2022-10-08 …

   Won't compile yet.
   Is a test of the iavl proof forgery as exploited during BSC 2022-10-07 hack.
   
   Notes:
   1. proof_forgery_test.go comes from cosmos/iavl#582
   2. gist showing the same vuln at https://gist.github.com/samczsun/8635f49fac0ec66a5a61080835cae3db
   
   The test is not going to compile as is, it needs some work.

   

   grepsuzette committed Mar 10, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for 8cf8f61
   • Browse repository at this point

   Copy the full SHA

   8cf8f61 View commit details

   Browse the repository at this point in the history

2. proof_forgery_test.go compiles, and fails the test as expected (-> vu… …

   …lnerable)
   
   output follows
   
   --- FAIL: TestProofForgery (0.00s)
       proof_forgery_test.go:69:
                   Error Trace:    /home/bob/opt/src/COINS/Cosmos/GNO/gno/pkgs/iavl/proof_forgery_test.go:69
                   Error:          Should be empty, but was [73 209 82 89 222 179 131 99 170 27 180 58 80 20 211 (...) 94 7 254 45 183 20 244]
                   Test:           TestProofForgery
                   Messages:       roothash must be empty if both left and right are set
   FAIL
   FAIL    command-line-arguments  0.003s
   FAIL

   

   grepsuzette committed Mar 10, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for b5d72c7
   • Browse repository at this point

   Copy the full SHA

   b5d72c7 View commit details

   Browse the repository at this point in the history

3. Test now passes whenever gnolang#583 is applied …

   and fails otherwise (fails when vuln not fixed)
   
   It should now be ok for review.

   

   grepsuzette committed Mar 10, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for 07f364a
   • Browse repository at this point

   Copy the full SHA

   07f364a View commit details

   Browse the repository at this point in the history