ghostchain/ghost-node
30
0
Fork 3
Code Issues 5 Pull Requests 25 Actions Packages Projects Releases Wiki Activity

fix for https://ghostforum.org/t/critical-utxo-multi-mint-via-non-canonical-varint-re-encoding/111

Browse Source 
Signed-off-by: Uncle Stinky <uncle.stinky@ghostchain.io>
This commit is contained in:
Uncle Stinky 2026-10-09 13:23:23 +03:00
parent 8abd114a5b
commit 84b6dfad9f
Signed by: st1nky
GPG Key ID: 016064BD97603B40
4 changed files with 121 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pallets/helpers/Cargo.toml
View File

@ -1,6 +1,6 @@
[package]
name = "ghost-helpers"
version = "0.0.11"
version = "0.0.12"
description = "Cryptographic utility suite for custom runtimes: optimized Bitmaps, UTXO parsing, Merkle Tree proofs, and Hash Chain components."
license.workspace = true
authors.workspace = true

9
pallets/helpers/src/utxo.rs
View File

@ -357,6 +357,9 @@ fn read_varint(bytes: &mut &[u8]) -> Result<usize, VarintError> {
.try_into()
.map_err(|_| VarintError::TypeConversionFailed)?,
);
if val < 0xfd {
return Err(VarintError::TypeConversionFailed);
}
*bytes = &bytes[2..];
Ok(val as usize)
}
@ -369,6 +372,9 @@ fn read_varint(bytes: &mut &[u8]) -> Result<usize, VarintError> {
.try_into()
.map_err(|_| VarintError::TypeConversionFailed)?,
);
if val < 0x10000 {
return Err(VarintError::TypeConversionFailed);
}
*bytes = &bytes[4..];
Ok(val as usize)
}
@ -381,6 +387,9 @@ fn read_varint(bytes: &mut &[u8]) -> Result<usize, VarintError> {
.try_into()
.map_err(|_| VarintError::TypeConversionFailed)?,
);
if val < 0x100000000 {
return Err(VarintError::TypeConversionFailed);
}
*bytes = &bytes[8..];
Ok(val as usize)
}

2
pallets/weaver/Cargo.toml
View File

@ -1,6 +1,6 @@
[package]
name = "ghost-weaver"
version = "0.0.14"
version = "0.0.15"
description = "Weaving a secure cryptographic tapestry across different external chains."
license.workspace = true
authors.workspace = true

110
pallets/weaver/src/tests.rs
View File

@ -801,6 +801,116 @@ fn should_successfully_pull_utxo_thread_and_mint_currency() {
});
}
#[test]
fn should_successfully_pull_utxo_thread_and_reject_nominal_varint_encoding() {
let pair = AuthorityPair::from_string("//Alice", None).expect("Should be valid seed");
let incoming_share = 0;
let network_id = 69;
let network_data = NetworkDataBuilder::default()
.with_network_type(NetworkType::Utxo)
.with_incoming_share(incoming_share)
.with_gatekeeper(
// Transaction: https://blockstream.info/tx/4a3fdd9ebb30b9c6df05d4199f8474b2f0c795d1f40a58d0d73342fc666b4a2e
hex::decode("4635b1794a22bfbe6c5c5eba17b693f4aaf0e348")
.expect("Bytes32 from UTXO should be valid"),
)
.build();
let authorities = vec![pair.clone()];
let networks = vec![(network_id, network_data, Default::default())];
// Real world tx at block #481838
// Block https://blockstream.info/block/0000000000000000011bdccb39e19e942a60edffdccd9779653c5b46b337904a
// Transaction: https://blockstream.info/tx/4a3fdd9ebb30b9c6df05d4199f8474b2f0c795d1f40a58d0d73342fc666b4a2e
let payload = (
// curl --data-binary '{"jsonrpc": "2.0", "id": "test-proof", "method": "gettxoutproof", "params": [["4a3fdd9ebb30b9c6df05d4199f8474b2f0c795d1f40a58d0d73342fc666b4a2e"], "0000000000000000011bdccb39e19e942a60edffdccd9779653c5b46b337904a"]}' -H 'Content-Type: application/json' https://bitcoin-rpc.publicnode.com
hex::decode("00000020375a14cfcf5730daa8ff8d7a5bd2cf59fba797e289c2e0000000000000000000529cd017146361b57e6b7353b16d8d38d32f92ee842039dd779d35bfbfa2f3e53f649e59e93c01187900ea9fb40600000cfbd7b718845d123b1ae1a7fd3bce9c97acba097dc912c4ac67a920395db07ba4eef685960869ba70e0ca38890565c97dc11f1d7ae538e7b509069f81e38eff1a2e4a6b66fc4233d7d0580af4d195c7f0b274849f19d405dfc6b930bb9edd3f4a4c1f1e9fa3a336c50e8ea16039e4db4bef7ff5946e3a019937bdf626c2336d0e3926a83a575218f84e6dc55ffb9d0997a41e4b4d5425a85f22160c9f52362a95021a573ff96bb429bd80a8ec9dcb899971553efe91b6a0fe57c4694c3e8da8dc7f1babd514f2746da1ed06f08664baed853c334e0a3917d0c859b19ee14f448f77e624822070db3b606d5092027ca9ecf7e0243e6c151081021ebb3ddcdd28c1b8f9fdcffebd1962590477675f3d29d52602a1e7e941f772a3bbff42cf2eb6e74a1124bf424f767e294ae6253a21602c7c6b0381743dd6dcd57b025983e0e34375b24f67ac8beb00713d2f70594bbf797d5d94c061cb9965e6458f2f017f983d7ce37361fa13fda372f595dc1f22895ab93339457c72c480fed1c4d1164a242303ff3600").expect("Bytes32 from UTXO should be valid"),
// curl --data-binary '{"jsonrpc": "2.0", "id": "test-proof", "method": "getrawtransaction", "params": ["4a3fdd9ebb30b9c6df05d4199f8474b2f0c795d1f40a58d0d73342fc666b4a2e", false]}' -H 'Content-Type: application/json' https://bitcoin-rpc.publicnode.com
hex::decode("010000000299a43fae581f80baf44e021ddf7b11995f184db282d6e48c22248b9fe79c43bb010000008b483045022100e9db01784dcd879c65d66127c2d52a4f9244321d15796893d6dccadaa1146e3d02203d9bb80f8df8b66692d3d9517f7cbb898d7cc40a30b175432322e1956c9b973a0141048097e4f8bb8ee104d5c2ece11d42f7e4719df8ddba459ecadecaba87d233c81a3c14830371392dd8ed030ef970450c0b7af48d9db4ba20c046896481602eb9dbffffffffb3fd05bc6000a5a0384e9a613d452e9307568df0a964907068e00403a0a0e09e020000006a47304402205bb1cbad4b29421648c1e22cac32a56aa06c933fe655559823fffb71ffebbc0b022021648d970560aa5b2031560b52a0fd06305995a58a457663324c18c1a9b0bd0b8121020d6e50b2660af27933c42bc1395fe93df90ffac5e2a989f6a134919fb8cf8075ffffffff030000000000000000296a2769642b5bb666ac1657090d02985f0cdb41436fe2d5a83a3acb1995d963a698e7e619e927bdcc5e7c150000000000001976a914c1c69d91a5719a23ba2094d89a4df3eadfa4aef788acefea2309000000001976a9144635b1794a22bfbe6c5c5eba17b693f4aaf0e34888ac00000000").expect("Bytes32 from UTXO should be valid"),
vec![
// curl --data-binary '{"jsonrpc": "2.0", "id": "test-proof", "method": "getblockheader", "params": ["000000000000000000e7da64065cc23d5c5a5aa402f088aaaf37c5fe1c3b6b92", false]}' -H 'Content-Type: application/json' https://bitcoin-rpc.publicnode.com
hex::decode("000000204a9037b3465b3c657997cddcffed602a949ee139cbdc1b010000000000000000669c3e2472384bc95993f154aada38d6b2113d8d32069e32e2724ba40915a1802a669e59e93c011801c8c735").expect("Bytes32 from UTXO should be valid"),
// curl --data-binary '{"jsonrpc": "2.0", "id": "test-proof", "method": "getblockheader", "params": ["00000000000000000063da6d9362c0ac3b87877d1c5ad7afd5bd706571d5b393", false]}' -H 'Content-Type: application/json' https://bitcoin-rpc.publicnode.com
hex::decode("02000020926b3b1cfec537afaa88f002a45a5a5c3dc25c0664dae7000000000000000000af0f270bf3f868d47089f395197809c360f1506636c960d96afed68bbd72d0b4496d9e59e93c01183ac94b67").expect("Bytes32 from UTXO should be valid"),
// curl --data-binary '{"jsonrpc": "2.0", "id": "test-proof", "method": "getblockheader", "params": ["000000000000000000ec6063eb743366264368be7ff5021727682cb518963026", false]}' -H 'Content-Type: application/json' https://bitcoin-rpc.publicnode.com
hex::decode("0000002093b3d5716570bdd5afd75a1c7d87873bacc062936dda630000000000000000009ab437e7c66b10a59b67127f290d24f381aba4e03d5e16c062a356eea4d608dea56d9e59e93c0118264f310e").expect("Bytes32 from UTXO should be valid"),
],
);
let encodings = vec![
vec![0x02], // canonical
vec![0xFD, 0x02, 0x00], // non-minimal 3 bytes
vec![0xFE, 0x02, 0x00, 0x00, 0x00], // non-minimal 5 bytes
vec![0xFF, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00], // non-minimal 9 bytes
];
new_test_ext(authorities, networks).execute_with(|| {
let session = 0;
let block_hash =
hex::decode("000000000000000000ec6063eb743366264368be7ff5021727682cb518963026")
.expect("Bitcoin Root hex should be valid");
let expected_root = H256::from_slice(&block_hash);
LoomStates::<TestRuntime>::insert(&network_id, &session, expected_root);
let expected_receiver_bytes = hex::decode("1657090d02985f0cdb41436fe2d5a83a3acb1995d963a698e7e619e927bdcc5e").unwrap();
let mut receiver_raw = [0u8; 32];
receiver_raw.copy_from_slice(&expected_receiver_bytes);
let receiver_account = sp_runtime::AccountId32::from(receiver_raw);
let transfer_amount: u64 = 153348847;
let mut expected_pure_amount: u64 = 0;
for (idx, enc) in encodings.iter().enumerate() {
let mut variant = Vec::with_capacity(payload.1.len() + enc.len() - 1);
variant.extend_from_slice(&payload.1[0..4]);
variant.extend_from_slice(&enc);
variant.extend_from_slice(&payload.1[5..]);
let utxo_thread_proof = UtxoThreadProof::new(payload.0.clone(), variant, payload.2.clone());
let thread_info = ThreadProof::UtxoThreadProof(utxo_thread_proof);
let pulled_thread_key = thread_info.get_unique_key(session, network_id);
assert_eq!(Balances::free_balance(&receiver_account), expected_pure_amount);
assert!(!PulledThreads::<TestRuntime>::contains_key(
&pulled_thread_key
));
let pull_result = GhostWeaver::pull_thread(
RuntimeOrigin::none(),
network_id,
session,
thread_info
);
if idx == 0 {
assert!(pull_result.is_ok());
assert!(PulledThreads::<TestRuntime>::contains_key(&pulled_thread_key));
let curve_share = Perbill::from_parts(incoming_share).mul_ceil(transfer_amount);
expected_pure_amount += transfer_amount.saturating_sub(curve_share);
assert_eq!(Balances::free_balance(&receiver_account), expected_pure_amount);
System::assert_last_event(RuntimeEvent::GhostWeaver(Event::ThreadPulled {
pulled_thread_key,
network_id,
receiver: receiver_account.clone(),
amount: transfer_amount,
}));
} else {
assert!(pull_result.is_err());
assert!(!PulledThreads::<TestRuntime>::contains_key(&pulled_thread_key));
assert_eq!(Balances::free_balance(&receiver_account), expected_pure_amount);
}
}
assert_eq!(Balances::free_balance(&receiver_account), transfer_amount);
});
}
#[test]
fn on_initialize_should_finalize_session_when_timeout_is_reached() {
let pair1 = AuthorityPair::from_string("//Alice", None).expect("Should be valid seed");