fix fir https://ghostforum.org/t/malicious-authority-can-permanently-kill-an-exodus-signing-session-via-an-undecodable-nonce-commitment/103

Signed-off-by: Uncle Stinky <uncle.stinky@ghostchain.io>

pallets/exodus/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ghost-exodus"
-version = "0.0.20"
+version = "0.0.21"
 description = "Threshold signature generation with DKG included"
 license.workspace = true
 authors.workspace = true

pallets/exodus/src/benchmarking.rs

@@ -481,7 +481,14 @@ mod benchmarks {
         let exodus_session = CurrentExodus::<T>::get();
 
         let dummy_address = EvmAddress::repeat_byte(69);
-        let dummy_nonce = vec![0u8; network_curve.element_bytes_len()];
+
+        // generator point for secp256k1
+        let dummy_nonce = [
+            0x02, 0x79, 0xbe, 0x66, 0x7e, 0xf9, 0xdc, 0xbb, 0xac, 0x55,
+            0xa0, 0x62, 0x95, 0xce, 0x87, 0x0b, 0x07, 0x02, 0x9b, 0xfc,
+            0xdb, 0x2d, 0xce, 0x28, 0xd9, 0x59, 0xf2, 0x81, 0x5b, 0x16,
+            0xf8, 0x17, 0x98
+        ];
 
         let create_bond = GovernanceAction::Create {
             market: [69, 420, 1337, 0],
@@ -509,8 +516,8 @@ mod benchmarks {
             .with_authority_index(authority_index)
             .with_exodus_nonce_commitment(
                 exodus_session,
-                dummy_nonce.clone(),
+                dummy_nonce.to_vec(),
-                dummy_nonce.clone(),
+                dummy_nonce.to_vec(),
             )
             .expect("Nonce commitment package should be valid");
 
@@ -536,8 +543,8 @@ mod benchmarks {
             authority_index,
         ).expect("Nonces should be registered during nonce commitment");
 
-        assert_eq!(registered_nonces.hiding, dummy_nonce.clone());
+        assert_eq!(registered_nonces.hiding.as_ref(), dummy_nonce);
-        assert_eq!(registered_nonces.binding, dummy_nonce);
+        assert_eq!(registered_nonces.binding.as_ref(), dummy_nonce);
 
         Ok(())
     }

pallets/exodus/src/impls/frost.rs

@@ -186,6 +186,19 @@ impl FlexibleRoundOptimizedSchnorrThresholdSignature<AuthIndex, ExodusError> for
         })
     }
 
+    fn is_nonce_valid_point(&self, nonce_bytes: &[u8]) -> Result<(), ExodusError> {
+        with_ciphersuite!(self, |f| {
+            type InnerGroup = <Ciphersuite as frost_core::Ciphersuite>::Group;
+
+            let serialized_nonce = <InnerGroup as frost_core::Group>::Serialization::try_from(nonce_bytes)
+                .map_err(|_| ExodusError::DeserializationError)?;
+
+            <InnerGroup as frost_core::Group>::deserialize(&serialized_nonce)
+                .map_err(|_| ExodusError::DeserializationError)
+                .map(|_| ())
+        })
+    }
+
     fn is_signature_valid(
         &self,
         verifying_key_bytes: &[u8],

pallets/exodus/src/lib.rs

@@ -3078,6 +3078,12 @@ impl<T: Config> Pallet<T> {
             return Err(InvalidTransaction::BadProof);
         }
 
+        network_curve.is_nonce_valid_point(&package.hiding_commitment)
+            .map_err(|_| InvalidTransaction::BadProof)?;
+
+        network_curve.is_nonce_valid_point(&package.binding_commitment)
+            .map_err(|_| InvalidTransaction::BadProof)?;
+
         if QualificationDkgState::<T>::get(&network_curve).is_dkg_pending() {
             return Err(InvalidTransaction::BadProof);
         }

pallets/traits/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ghost-traits"
-version = "0.4.6"
+version = "0.4.7"
 description = "Shared traits including `GhostHasher`, `NetworkDataBasicHandler`, `BoundedBTreeMap`, `MerkleTree` and more."
 license.workspace = true
 authors.workspace = true

pallets/traits/src/exodus.rs

@@ -33,6 +33,7 @@ pub trait FlexibleRoundOptimizedSchnorrThresholdSignature<A, E>: MerkleTreeBuild
         vk: &[u8],
         m: &[u8],
     ) -> Result<(), E>;
+    fn is_nonce_valid_point(&self, b: &[u8]) -> Result<(), E>;
     fn is_signature_valid(&self, vk: &[u8], r: &[u8], z: &[u8], m: &[u8]) -> Result<(), E>;
     fn accumulate_signature_scalar(&self, ss: &[u8], sh: &[u8]) -> Result<Vec<u8>, E>;