fix is_valid_indexed_attestation() to check for high attestation indices #1214
Conversation
| if indices.asSeq != sorted(toHashSet(indices.asSeq).toSeq, system.cmp): | ||
| notice "indexed attestation: indices not sorted" | ||
| let indices = indexed_attestation.attesting_indices.asSeq | ||
| if len(indices) == 0 or not is_sorted_and_unique(indices): |
There was a problem hiding this comment.
nitpick, but I'd move the len(indices) == 0 into is_sorted_and_unique
There was a problem hiding this comment.
Part of that factoring was that this template might be moved elsewhere, and this particular check on 0-length is specific to how is_valid_indexed_attribution() as opposed to the other sorted-and-unique-checks, of which there's a couple elsewhere in the spec.
This was a minimal, local change, but with a slightly broader vision.
There was a problem hiding this comment.
the point was more that a 0-length seq is by definition sorted and unique so it's safer to keep the check in there (if it does indeed get copied to some generic function - as opposed to crashing with a Defect when [0-1] happens
There was a problem hiding this comment.
Sure, the point of that special case from the spec is to reject the trivially sorted and unique 0-length sequence, despite it being sorted and unique. It's not redundant, and it's not part of an actual is_sorted_and_unique (exact name aside) sort of function. It has the opposite polarity.
Check if ``indexed_attestation`` is not empty, has sorted and unique indices and has a valid aggregate signature.
...
if len(indices) == 0 or not indices == sorted(set(indices)):
return False
Addresses #1207
One obvious question here is whether this is just an artifact of the back-end expecting sanitized data, which would ordinarily be guaranteed, but at least we use
is_valid_indexed_attestation()in places, such asisValidAttestation(), where it's directly exposed to arbitrary external input, and it looks like viaprocess_operations()->process_attester_slashing()->is_valid_indexed_attestation(), this could slip through without having been checked even in the direct spec pseudocode.