Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Staking] Extra check for Virtual Stakers #5791

Closed
Ank4n opened this issue Sep 20, 2024 · 0 comments · Fixed by #5985
Closed

[Staking] Extra check for Virtual Stakers #5791

Ank4n opened this issue Sep 20, 2024 · 0 comments · Fixed by #5985
Assignees
@Ank4n
Labels
I9-optimisation An enhancement to provide better overall performance in terms of time-to-completion for a task. T2-pallets This PR/Issue is related to a particular pallet.

Comments

@Ank4n
Copy link
Contributor

Ank4n commented Sep 20, 2024

In staking, virtual stakers are system generated keys to manage ledger for pool accounts. These accounts do not need to exist (and will not exist unless some account transfers funds to it to mess with the system).

Only pallets (trusted modules) have access to create these type of stakers via the trait StakingUnchecked. pallet-staking does not do any validation on it.

Defensively, we could add the following

  • ensure nonce (transaction count) of virtual_staker is zero. Since this account is keyless, it can never sign its own transaction.
  • Try state check to ensure all existing virtual_stakers have zero nonce.
@Ank4n Ank4n added the I9-optimisation An enhancement to provide better overall performance in terms of time-to-completion for a task. label Sep 20, 2024
@Ank4n Ank4n self-assigned this Sep 20, 2024
@Ank4n Ank4n added the T2-pallets This PR/Issue is related to a particular pallet. label Sep 20, 2024
@Ank4n Ank4n mentioned this issue Oct 8, 2024
Merged
github-merge-queue bot pushed a commit that referenced this issue Nov 5, 2024
@Ank4n @bkchr
[pallet-staking] Additional check for virtual stakers (#5985)
be26d62 
closes #5791.

This is not strictly necessary but serves as a defensive check.

The staking pallet exposes
[apis](https://paritytech.github.io/polkadot-sdk/master/sp_staking/trait.StakingUnchecked.html#tymethod.virtual_bond)
that other runtime pallets (pallet-delegated-staking) can use to create
virtual stakers. However, there’s no way for pallet-staking to ensure
that the staker is truly keyless. If the caller (this is a trusted
caller so this would only happen due to a bug) registers an account with
a private key as a virtual_staker, these accounts could later interact
directly with pallet-staking dispatchables (such as
[bond_extra](https://paritytech.github.io/polkadot-sdk/master/pallet_staking/dispatchables/fn.bond_extra.html))
and bypass any locking mechanism. The check above ensures this scenario
can never occur by performing an integrity check.

---------

Co-authored-by: Bastian Köcher <git@kchr.de>
Co-authored-by: command-bot <>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@Ank4n Ank4n

Labels
I9-optimisation An enhancement to provide better overall performance in terms of time-to-completion for a task. T2-pallets This PR/Issue is related to a particular pallet.
Projects
(Nominated) Proof of Stake
Status: ✅ Done
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[pallet-staking] Additional check for virtual stakers paritytech/polkadot-sdk
1 participant
@Ank4n