This repository has been archived by the owner on Nov 15, 2023. It is now read-only.
Fix PoV attack vector for contracts #10301
Labels
I2-security
The client fails to follow expected, security-sensitive, behaviour.
As of right now PoV sites are not reflected as a resource in our FRAME based run times. For fixed functionality pallets this isn't a show stopper because they can be written in a way that users cannot exploit this (
BoundedVec
etc.).However every chain that has the contracts pallet might susceptible to this easy exploit: Craft a transaction that calls many contracts that are big in code size but small in weight (they return immediately). This will choke the throughput without causing an appropriate amount of fees.
The current progress of a proper integration into FRAME is tracked in paritytech/polkadot-sdk#398. This might be too late for us as we cannot launch without it. We have multiple possibilities to protect us from that exploit in the meantime:
The text was updated successfully, but these errors were encountered: