Verify the hashes match for latestHash in 'chelonia/private/in/syncContract'

[taoeffect]

Problem

In 'chelonia/private/in/syncContract', we have this line:

const latest = await sbp('chelonia/out/latestHash', contractID)

We then fetch the events up to whatever the latest hash is (since the most recent message we've processed):

const events = await sbp('chelonia/out/eventsSince', contractID, recent || contractID)

We currently do not verify that the latest hash is among those messages received, but we should.

Solution

Call GIMessage.deserialize on all the messages first, then starting from the end of the list, check to make sure one of the messages' hashes matches latest. If no such message can be found throw an error. Otherwise proceed with calling 'chelonia/private/in/handleEvent'

[Silver-IT]

@taoeffect, when could this issue be happening?

[taoeffect]

@Silver-IT if the server is compromised or there's a bug in the code