Multisign issue with repeated signatures in tx

[corsaro1]

I broadcasted 840 tx this evening on testnet, to cosign them later. I expected all nodes receive same data

I noted that on the server where I cosigned the tx, reading unsigned tx (/api/node/transactions/unsigned?offset=0&limit=100) it has regularly 2 signatures (I cosigned them with 2 priv keys on a total of 3)
result is this:
{"amount":"10","recipientId":"15797001169110345751L","senderPublicKey":"15b50402822a1ecc3d8f17ccae407858078a21ca940cfa919ec42ed50c4e612f","timestamp":68438429,"type":0,"fee":"10000000","asset":{},"signature":"050673ba60e30ee803a5b2d776afb78e6d0a22ce63c6cae1e4f23019600776e0fa15bc1ebe57d3f5f232d6fa83261abd73ecc51b3013f4f657dca288da42370d","id":"11993133628867109456","signatures":["7ddca64be39468c82c9e89a30c3756ff35eafce8b62c1ff1a6fb593e17c71bf985bfba73c88375eec15be23108466ac78a59602cc40bd09d1ccd725c514fb801","b688dadb9bb9e2b3ab1c50c5ea0e3fd5cc4f8906f1cfd407dea844c43364658aca59f95b4b04bad5a6f51c67420763b99ce371bd75bc86863cf010d6f188500c"],"senderId":"17803179600206889337L","relays":1,"receivedAt":"2018-07-25T19:40:29.202Z","ready":true,"recipientPublicKey":""}

Instead on a secondary node, who receives the tx directly broadcasted from the network, I noted the same tx, but with a lot of repeated signatures like this:

{"amount":"10","recipientId":"15797001169110345751L","senderPublicKey":"15b50402822a1ecc3d8f17ccae407858078a21ca940cfa919ec42ed50c4e612f","timestamp":68438429,"type":0,"fee":"10000000","asset":{},"signature":"050673ba60e30ee803a5b2d776afb78e6d0a22ce63c6cae1e4f23019600776e0fa15bc1ebe57d3f5f232d6fa83261abd73ecc51b3013f4f657dca288da42370d","id":"11993133628867109456","signatures":["b688dadb9bb9e2b3ab1c50c5ea0e3fd5cc4f8906f1cfd407dea844c43364658aca59f95b4b04bad5a6f51c67420763b99ce371bd75bc86863cf010d6f188500c","b688dadb9bb9e2b3ab1c50c5ea0e3fd5cc4f8906f1cfd407dea844c43364658aca59f95b4b04bad5a6f51c67420763b99ce371bd75bc86863cf010d6f188500c","b688dadb9bb9e2b3ab1c50c5ea0e3fd5cc4f8906f1cfd407dea844c43364658aca59f95b4b04bad5a6f51c67420763b99ce371bd75bc86863cf010d6f188500c","b688dadb9bb9e2b3ab1c50c5ea0e3fd5cc4f8906f1cfd407dea844c43364658aca59f95b4b04bad5a6f51c67420763b99ce371bd75bc86863cf010d6f188500c","b688dadb9bb9e2b3ab1c50c5ea0e3fd5cc4f8906f1cfd407dea844c43364658aca59f95b4b04bad5a6f51c67420763b99ce371bd75bc86863cf010d6f188500c","b688dadb9bb9e2b3ab1c50c5ea0e3fd5cc4f8906f1cfd407dea844c43364658aca59f95b4b04bad5a6f51c67420763b99ce371bd75bc86863cf010d6f188500c","b688dadb9bb9e2b3ab1c50c5ea0e3fd5cc4f8906f1cfd407dea844c43364658aca59f95b4b04bad5a6f51c67420763b99ce371bd75bc86863cf010d6f188500c","b688dadb9bb9e2b3ab1c50c5ea0e3fd5cc4f8906f1cfd407dea844c43364658aca59f95b4b04bad5a6f51c67420763b99ce371bd75bc86863cf010d6f188500c","b688dadb9bb9e2b3ab1c50c5ea0e3fd5cc4f8906f1cfd407dea844c43364658aca59f95b4b04bad5a6f51c67420763b99ce371bd75bc86863cf010d6f188500c","b688dadb9bb9e2b3ab1c50c5ea0e3fd5cc4f8906f1cfd407dea844c43364658aca59f95b4b04bad5a6f51c67420763b99ce371bd75bc86863cf010d6f188500c"],"senderId":"17803179600206889337L","relays":3,"receivedAt":"2018-07-25T19:40:39.572Z","ready":true,"recipientPublicKey":""}

I initially broadcasted 840 tx on testnet, and then I cosigned them using 2 accounts

Issue affects testnet core 1.0.0-rc.1

[4miners]

@corsaro1 Thank you for reporting that, we will investigate asap.

[diego-G]

@4miners please investigate is this has to be fixed for v1.0.0 or it can wait.

[4miners]

I think the problem is in processSignature function. Only part of the logic there is performed via balancesSequence, so it is possible that when node receive multiple signatures at one - they all will pass a check here:
https://github.com/LiskHQ/lisk/blob/ad7836b6057283ecf8d99c4df44701ce28c1beb2/modules/multisignatures.js#L205-L209 It's because that check is performed outside of sequence.
Signatures are added here (via balancesSequence):
https://github.com/LiskHQ/lisk/blob/ad7836b6057283ecf8d99c4df44701ce28c1beb2/modules/multisignatures.js#L124

There are also two calls to modules.accounts.getAccount function, which can be unified.

[MaciejBaj]

Merged into v1.0.3 in af1de56