fix: prevent malicious peer DoS in block sync#940
Conversation
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughUpdates Tendermint dependency from v0.3.4 to v0.3.6 across Makefile and eight go.mod files, alongside synchronized updates to golang.org/x/* indirect dependencies and go-resty in select modules. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@ops/l2-genesis/go.mod`:
- Around line 68-73: Replace the invalid module version for golang.org/x/time in
go.mod: change the entry golang.org/x/time v0.12.0 to a valid release (v0.15.0)
and then update the module graph by running go get golang.org/x/time@v0.15.0 (or
run go mod tidy) so go.sum and dependencies are reconciled; verify the line with
golang.org/x/time now reads v0.15.0 alongside the other golang.org/x/* entries.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: fd80c98c-7ec8-422d-94ab-739a428a3785
⛔ Files ignored due to path filters (6)
bindings/go.sumis excluded by!**/*.sumcontracts/go.sumis excluded by!**/*.sumnode/go.sumis excluded by!**/*.sumops/tools/go.sumis excluded by!**/*.sumoracle/go.sumis excluded by!**/*.sumtx-submitter/go.sumis excluded by!**/*.sum
📒 Files selected for processing (8)
Makefilebindings/go.modcontracts/go.modnode/go.modops/l2-genesis/go.modops/tools/go.modoracle/go.modtx-submitter/go.mod
| golang.org/x/crypto v0.41.0 // indirect | ||
| golang.org/x/net v0.43.0 // indirect | ||
| golang.org/x/sync v0.16.0 // indirect | ||
| golang.org/x/sys v0.35.0 // indirect | ||
| golang.org/x/text v0.28.0 // indirect | ||
| golang.org/x/time v0.12.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
Are the following golang.org/x package versions valid: crypto v0.41.0, net v0.43.0, sync v0.16.0, sys v0.35.0, text v0.28.0, time v0.12.0?
💡 Result:
No, not all of the specified golang.org/x package versions are valid as of 2026-04-24. While most exist (crypto v0.41.0, net v0.43.0, sync v0.16.0, sys v0.35.0 appears plausible within the range up to v0.43.0, text v0.28.0 plausible within range up to v0.36.0), time v0.12.0 does not exist. The latest for x/time is v0.15.0, with prior versions v0.14.x, v0.13.x, v0.12.1 pseudo-version (not tagged v0.12.0), v0.13.0, etc. No tagged v0.12.0 for x/time is listed in version histories on pkg.go.dev or deps.dev.
Citations:
- 1: https://pkg.go.dev/golang.org/x/crypto
- 2: https://pkg.go.dev/golang.org/x/crypto?tab=versions
- 3: https://pkg.go.dev/golang.org/x/net
- 4: https://pkg.go.dev/golang.org/x/net?tab=versions
- 5: https://pkg.go.dev/golang.org/x/sync
- 6: https://pkg.go.dev/golang.org/x/sync?tab=versions
- 7: https://pkg.go.dev/golang.org/x/sys?tab=versions
- 8: https://pkg.go.dev/golang.org/x/sys
- 9: https://pkg.go.dev/golang.org/x/text?tab=versions
- 10: https://pkg.go.dev/golang.org/x/time
- 11: https://deps.dev/go/golang.org%2Fx%2Ftime/v0.15.0/versions
- 12: https://go.googlesource.com/crypto/%2B/refs/tags/v0.41.0
- 13: https://go.googlesource.com/net/%2B/refs/tags/v0.43.0
- 14: https://pkg.go.dev/golang.org/x/sync@v0.16.0
🏁 Script executed:
cat -n ops/l2-genesis/go.mod | grep -A 10 "golang.org/x/crypto"Repository: morph-l2/morph
Length of output: 615
Update golang.org/x/time to a valid version; v0.12.0 does not exist.
The dependency golang.org/x/time v0.12.0 on line 73 is invalid—no such tagged release exists. The latest version is v0.15.0. Update this dependency to a valid version. The other golang.org/x/* packages (crypto v0.41.0, net v0.43.0, sync v0.16.0, sys v0.35.0, text v0.28.0) are valid.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@ops/l2-genesis/go.mod` around lines 68 - 73, Replace the invalid module
version for golang.org/x/time in go.mod: change the entry golang.org/x/time
v0.12.0 to a valid release (v0.15.0) and then update the module graph by running
go get golang.org/x/time@v0.15.0 (or run go mod tidy) so go.sum and dependencies
are reconciled; verify the line with golang.org/x/time now reads v0.15.0
alongside the other golang.org/x/* entries.
2 participants
Summary by CodeRabbit
Release Notes