0xMiden / 0xMiden/protocol

bug: SignedBlock::Deserializable skips signature verification upstream block acceptance without validation

Ouverte
#3,199 2 commentaires 0 réactions 0 personnes assignées Voir sur GitHub
Langage dominant
Rust
Étoiles
132
Forks
167
Merge moyen
1 j 23 h
PR mergées (30 j)
110

Description

## Summary

`SignedBlock::read_from` (the `Deserializable` impl) constructs the struct directly from deserialized fields without calling `validate`, which means **signature verification is skipped** during deserialization.

This is in contrast to `ProposedBatch::read_from`, which correctly calls `new_batch_inner` to validate deserialized data.

## Affected Validation

The following checks from `SignedBlock::validate` are bypassed:

- **Signature verification**: `signature.verify(header.commitment(), signer)` ensures the block header was actually signed by the claimed validator
- **Parent header consistency**: `header.prev_block_commitment() == parent.commitment()` ensures the block correctly links to the chain

## Impact

In `miden-node`, `rpc_sync.rs` deserializes blocks from upstream via `SignedBlock::read_from_bytes` and immediately applies them via `apply_block`. The `apply_block` path calls `validate_block_header`, which checks tx_commitment and block sequence, but **does not verify the signature**.

This means a compromised or malicious upstream node could feed a tampered `SignedBlock` that passes sequence checks but has an invalid or forged signature, and the syncing node would accept it.

## Contrast with ProposedBatch

`ProposedBatch::read_from` calls `new_batch_inner` during deserialization, ensuring all validation runs. `SignedBlock` should do the same with `validate`.

## Suggested Fix

Call `validate` (or an equivalent validation routine) in `SignedBlock::read_from`, or require callers to validate explicitly before `apply_block`.

## References

- `SignedBlock::read_from` (no validation): `crates/miden-protocol/src/block/signed_block.rs:206`
- `SignedBlock::validate` (signature check): `crates/miden-protocol/src/block/signed_block.rs:152`
- `apply_block` (no signature verify): `crates/miden-node/crates/store/src/state/apply_block.rs:101`
- `rpc_sync` (upstream deserialization): `crates/miden-node/crates/block-producer/src/rpc_sync.rs:142`

Guide de contribution

Ouvrir le guide de contribution

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.