0xMiden / 0xMiden/protocol

bug: SignedBlock::Deserializable skips signature verification upstream block acceptance without validation

Abierto
#3,199 2 comentarios 0 reacciones 0 asignados Ver en GitHub
Lenguaje dominante
Rust
Estrellas
132
Forks
167
Merge medio
1 d 23 h
PR fusionados (30 d)
110

Descripción

## Summary

`SignedBlock::read_from` (the `Deserializable` impl) constructs the struct directly from deserialized fields without calling `validate`, which means **signature verification is skipped** during deserialization.

This is in contrast to `ProposedBatch::read_from`, which correctly calls `new_batch_inner` to validate deserialized data.

## Affected Validation

The following checks from `SignedBlock::validate` are bypassed:

- **Signature verification**: `signature.verify(header.commitment(), signer)` ensures the block header was actually signed by the claimed validator
- **Parent header consistency**: `header.prev_block_commitment() == parent.commitment()` ensures the block correctly links to the chain

## Impact

In `miden-node`, `rpc_sync.rs` deserializes blocks from upstream via `SignedBlock::read_from_bytes` and immediately applies them via `apply_block`. The `apply_block` path calls `validate_block_header`, which checks tx_commitment and block sequence, but **does not verify the signature**.

This means a compromised or malicious upstream node could feed a tampered `SignedBlock` that passes sequence checks but has an invalid or forged signature, and the syncing node would accept it.

## Contrast with ProposedBatch

`ProposedBatch::read_from` calls `new_batch_inner` during deserialization, ensuring all validation runs. `SignedBlock` should do the same with `validate`.

## Suggested Fix

Call `validate` (or an equivalent validation routine) in `SignedBlock::read_from`, or require callers to validate explicitly before `apply_block`.

## References

- `SignedBlock::read_from` (no validation): `crates/miden-protocol/src/block/signed_block.rs:206`
- `SignedBlock::validate` (signature check): `crates/miden-protocol/src/block/signed_block.rs:152`
- `apply_block` (no signature verify): `crates/miden-node/crates/store/src/state/apply_block.rs:101`
- `rpc_sync` (upstream deserialization): `crates/miden-node/crates/block-producer/src/rpc_sync.rs:142`

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.