Fix potential DoS vector for masternode payments #2071
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
sidhujag
reviewed
May 8, 2018
| // Avoid processing same vote multiple times | ||
| if(!res.second) { | ||
| // Avoid processing same vote multiple times if it was already verified earlier | ||
| if(!res.second && res.first->second.IsVerified()) { |
There was a problem hiding this comment.
This doesn't actually solve the problem. If an attacker uses a bad signature it will pass and add to mapMasternodePaymentVotes yet vchsig will be non-empty and this check is just a NOP. Don't you need to move this under the sig check like I did in my initial PR?
There was a problem hiding this comment.
Ahh I see so vchsig will be cleared anyway and this will basically reprocess if it was a bad vote that was stored and for a good vote vchsig would have been filled later so it returns right away, makes sense thanks!
Yoyae
pushed a commit
to monacocoin-net/monoeci-core
that referenced
this pull request
May 28, 2018
* Skip only already verified mn payments vote duplicates * Update mn payment vote stats only if mn payment vote sig is ok
andvgal
pushed a commit
to energicryptocurrency/gen2-energi
that referenced
this pull request
Jan 6, 2019
* Skip only already verified mn payments vote duplicates * Update mn payment vote stats only if mn payment vote sig is ok
CryptoCentric
pushed a commit
to absolute-community/absolute
that referenced
this pull request
Mar 1, 2019
* Skip only already verified mn payments vote duplicates * Update mn payment vote stats only if mn payment vote sig is ok
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
A less invasive alternative (logic-wise) to #2070