This repository was archived by the owner on Jan 22, 2025. It is now read-only.
Prevent runtime from using messages with version 127 #29807
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
CriesofCarrots
previously approved these changes
Jan 26, 2023
There was a problem hiding this comment.
Looks reasonable to me, but would be good to get @t-nelson to sanity check as well.
t-nelson
previously approved these changes
Jan 27, 2023
d70994c
CriesofCarrots
approved these changes
Feb 11, 2023
2 tasks
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem
To prevent social attacks by which the signer is tricked into signing a transaction, the runtime MUST NOT accept signed off-chain messages as transactions under any circumstances. The first byte of the signing domain specifier is chosen such that it corresponds to a value (
0xff) which is implicitly illegal as the first byte in a transactionMessageHeadertoday. The property is implicit because the top bit in the first byte of aMessageHeaderbeing set signals a versioned transaction, but only a value of zero is supported at this time. The runtime needs to be modified to reserve 127 as an illegal version number, making this property explicit.Summary of Changes
Deserialization of VersionedMessage
Fixes #