Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Maximum gas logic doesn't account for overflows #2995

Closed
2 tasks
ValarDragon opened this issue Dec 10, 2018 · 1 comment
Closed
2 tasks

Maximum gas logic doesn't account for overflows #2995

ValarDragon opened this issue Dec 10, 2018 · 1 comment
Labels
C:consensus Component: Consensus C:mempool Component: Mempool T:security Type: Security (specify priority)
Milestone

Comments

@ValarDragon
Copy link
Contributor

ValarDragon commented Dec 10, 2018

This is another currently exploitable that will happen w.r.t. to gas wanted. The app can send multiple gas wanteds on the order of 2**62 or 2**63. Addition of these can cause overflow into a very small positive value. Then tendermint will have proposed a block with a much larger amount of gas than the gas limit. This is a problem both in the mempool, block validation logic, and existing cosmos application logic.

  • Fix overflow in Mempool Reap
  • Fix overflow in block validation before precommitting

I'll make a separate issue for the SDK.

@ValarDragon ValarDragon added C:mempool Component: Mempool C:consensus Component: Consensus T:security Type: Security (specify priority) labels Dec 10, 2018
@ValarDragon ValarDragon added this to the launch milestone Dec 10, 2018
@ValarDragon
Copy link
Contributor Author

This problem didn't actually exist due to the way we structured the > -1 checks! The existing problem was fixed by #2994

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
C:consensus Component: Consensus C:mempool Component: Mempool T:security Type: Security (specify priority)
Projects
None yet
Development

No branches or pull requests

1 participant