Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ccvTimeoutTimestamp should be included in consumer addition proposal #388

Closed
shaspitz opened this issue Oct 11, 2022 · 1 comment
Closed
Labels
type: bug Issues that need priority attention -- something isn't working

Comments

@shaspitz
Copy link
Contributor

Problem

This PR #376 enables the provider and the consumers to have different CCV timeout periods. This could have negative implications on security, if a consumer chain is able to make this timeout parameter dangerously small. Note that a consumer could have changed this hardcoded parameter before #376

We should better expose this parameter to provider validators when a consumer chain is being spawned, and perhaps include the parameter in the consumer addition proposal. We should also not allow this parameter to be changed through consumer governance.

Closing criteria

Fix the issues described above

@shaspitz shaspitz added the type: bug Issues that need priority attention -- something isn't working label Oct 11, 2022
@mpoke mpoke moved this to Todo in Replicated Security Oct 11, 2022
@jtremback
Copy link
Contributor

As we discussed today, this should probably just go in the regular consumer param section and defaults. The genesis.json for a new consumer needs to be checked carefully.

Repository owner moved this from Todo to Done in Replicated Security Oct 18, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type: bug Issues that need priority attention -- something isn't working
Projects
No open projects
Status: Done
Development

No branches or pull requests

2 participants