-
Notifications
You must be signed in to change notification settings - Fork 1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix Oracle PostPersist #2074
Fix Oracle PostPersist #2074
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Isn't it solved by
neo/src/neo/Network/P2P/Payloads/OracleResponse.cs
Lines 71 to 72 in a1590b0
OracleRequest request = NativeContract.Oracle.GetRequest(snapshot, Id); | |
if (request is null) return false; |
if (oracle != null && | ||
(!oracleRequests.TryGetValue(oracle.Id, out var hash) || hash != tx.Hash)) | ||
{ | ||
return false; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
BTW, this can be replaced with generic "Conflicts" mechanism (#1991) that would also allow for proper transaction to have higher priority over fallback.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Regarding the description of checking if the transaction was sucesfull you removed that part, right?
As it is right now it is only improving the caching mechanism for avoiding duplicate txs?
UT failed |
/// Store oracle responses | ||
/// </summary> | ||
private readonly Dictionary<ulong, UInt256> oracleResponses = new Dictionary<ulong, UInt256>(); | ||
|
||
public void AddTransaction(Transaction tx) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why don't remove CheckTransaction
and Change Add to bool TryAdd
(thread-safe)?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Because CheckTransaction
is called in Transaction.Verify()
.
Merge? |
When processing an oracle’s response transaction, it is not verified that the transaction is successful which allows a group of oracle’s nodes to sign a transaction that will throw an exception in the
PostPersist
method, causing a Denial of Service.Found by @Red4Sec