Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add NetworkID to Warp Message and Remove DestinationChainID #1682

Closed
aaronbuchwald opened this issue Jul 3, 2023 · 1 comment
Closed

Add NetworkID to Warp Message and Remove DestinationChainID #1682

aaronbuchwald opened this issue Jul 3, 2023 · 1 comment

Comments

@aaronbuchwald
Copy link
Collaborator

Avalanche Warp Messaging in AvalancheGo is intended to support the minimum shared spec across how VMs will use it.

As a result, we should remove the destinationChainID field, which may not be needed when performing a broadcast operation and leave it to the VM to define the destinationChainID if needed.

Additionally, if the P-Chain is ever going to sign warp messages directly, then we should add a networkID field.

With the exception of the P-Chain, every blockchain on an Avalanche network's blockchainID is the hash of the transaction that created it. However, the P-Chain is an empty 32 byte value (same as the Primary Network subnetID).

For most blockchains signing a warp message, the blockchainID will be uniquified across different Avalanche networks because every transaction on the P-Chain requires a networkID resulting in unique transactions across different networks.

However, since the P-Chain hardcodes its blockchainID to an empty 32 byte value, this creates a replay attack vector if the P-Chain ever signs Avalanche Warp Messages using the same BLS private key as a different network. To prevent this, we should add a networkID into Avalanche Warp Messages for replay protection.

ramilexe pushed a commit to ConsiderItDone/avalanchego that referenced this issue Jul 14, 2023
@aaronbuchwald
Copy link
Collaborator Author

Addressed by #1686

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
No open projects
Archived in project
Development

No branches or pull requests

1 participant