0xMiden / 0xMiden/protocol

bug: SignedBlock::Deserializable skips signature verification upstream block acceptance without validation

Open
#3,199 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
132
Forks
167
Avg merge
1d 23h
Merged PRs (30d)
110

Description

## Summary

`SignedBlock::read_from` (the `Deserializable` impl) constructs the struct directly from deserialized fields without calling `validate`, which means **signature verification is skipped** during deserialization.

This is in contrast to `ProposedBatch::read_from`, which correctly calls `new_batch_inner` to validate deserialized data.

## Affected Validation

The following checks from `SignedBlock::validate` are bypassed:

- **Signature verification**: `signature.verify(header.commitment(), signer)` ensures the block header was actually signed by the claimed validator
- **Parent header consistency**: `header.prev_block_commitment() == parent.commitment()` ensures the block correctly links to the chain

## Impact

In `miden-node`, `rpc_sync.rs` deserializes blocks from upstream via `SignedBlock::read_from_bytes` and immediately applies them via `apply_block`. The `apply_block` path calls `validate_block_header`, which checks tx_commitment and block sequence, but **does not verify the signature**.

This means a compromised or malicious upstream node could feed a tampered `SignedBlock` that passes sequence checks but has an invalid or forged signature, and the syncing node would accept it.

## Contrast with ProposedBatch

`ProposedBatch::read_from` calls `new_batch_inner` during deserialization, ensuring all validation runs. `SignedBlock` should do the same with `validate`.

## Suggested Fix

Call `validate` (or an equivalent validation routine) in `SignedBlock::read_from`, or require callers to validate explicitly before `apply_block`.

## References

- `SignedBlock::read_from` (no validation): `crates/miden-protocol/src/block/signed_block.rs:206`
- `SignedBlock::validate` (signature check): `crates/miden-protocol/src/block/signed_block.rs:152`
- `apply_block` (no signature verify): `crates/miden-node/crates/store/src/state/apply_block.rs:101`
- `rpc_sync` (upstream deserialization): `crates/miden-node/crates/block-producer/src/rpc_sync.rs:142`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.