Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Verify votes before proposing #2460

Closed
corverroos opened this issue Nov 12, 2024 · 0 comments
Closed

Verify votes before proposing #2460

corverroos opened this issue Nov 12, 2024 · 0 comments
Assignees
@corverroos
Labels
cantina
Milestone
c1.1 - Mainnet Be...

Comments

@corverroos
Copy link
Collaborator

corverroos commented Nov 12, 2024 •
edited
Loading

Problem to Solve

We don't verify votes in PrepareProposal, this can be exploited by malicious validators to prevent proposals. This is because VerifyVoteExtension isn't called in all cases. The LastLocalCommit may therefore contain invalid votes, which a unsuspecting validator might propose.

Proposed Solution

Verify and discard invalid votes in PrepareProposal.
@corverroos corverroos changed the title Verify votes every time Verify votes before proposing Nov 14, 2024
@corverroos corverroos mentioned this issue Nov 14, 2024
Merged
@corverroos corverroos added this to the 1.1 - Mainnet Beta [Dec 4] milestone Nov 14, 2024
@corverroos corverroos self-assigned this Nov 14, 2024
corverroos added a commit that referenced this issue Nov 15, 2024
@corverroos
fix(halo/attest): verify votes before proposing (#2482)
d73b69a 
Verify (and discard) invalid votes before proposing. This is required
since VerifyVoteExtension isn't always called, so LastLocalCommit may
contain invalid votes.

issue: #2460
@fabtreb fabtreb closed this as completed Nov 18, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@corverroos corverroos

Labels
cantina
Projects
None yet
Milestone
c1.1 - Mainnet Beta [Dec 17]
Development

No branches or pull requests
2 participants
@corverroos @fabtreb