Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Proposal Related Fixes GRPH-60 #80

Open
bobinson opened this issue Aug 26, 2019 · 3 comments
Open

Proposal Related Fixes GRPH-60 #80

bobinson opened this issue Aug 26, 2019 · 3 comments
Assignees
Labels
bug Something isn't working

Comments

@bobinson
Copy link

There are handful of security and stability related issues wrt Proposals.

bitshares/bitshares-core#1257

bitshares/bitshares-core#1479

https://www.bitshares.foundation/announcements/2018-12-21-proposal-incident

We need to upgrade the Peerplays blockchain with similar fixes.

@bobinson bobinson changed the title Proposal Related Fixes Proposal Related Fixes GRPH-60 Aug 26, 2019
@bobinson bobinson added the bug Something isn't working label Aug 26, 2019
@sierra19XX
Copy link

There can be a Proposal created many levels of depth.

To prevent this while pushing a proposal, Bitshares check for the level of recursion inside Proposal operations. If it is > 2 * (No. of Witness nodes), an exception will be thrown.

From the Peerplays code I’ve investigated, there is no such check to stop processing a deeply nested proposal.

I feel there are two ways to introduce this in Peerplays,

  1. The way Bitshares are doing i.e. during push_proposal we check the level/depth of recursion required.

  2. (Another way) Is it a better approach to evaluate a proposal depth at the creation of the Proposal itself?

@bobinson
Copy link
Author

@oxarbitrage - Do you have comments about above discussion ?

@bobinson
Copy link
Author

bobinson commented Sep 4, 2019

PR : #85

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants