0xMiden / 0xMiden/protocol

bug: SignedBlock::Deserializable skips signature verification upstream block acceptance without validation

Aperta
#3,199 2 commenti 0 reazioni 0 assegnatari Vedi su GitHub
Lingua principale
Rust
Stelle
132
Fork
167
Merge medio
1g 23h
PR unite (30g)
110

Descrizione

## Summary

`SignedBlock::read_from` (the `Deserializable` impl) constructs the struct directly from deserialized fields without calling `validate`, which means **signature verification is skipped** during deserialization.

This is in contrast to `ProposedBatch::read_from`, which correctly calls `new_batch_inner` to validate deserialized data.

## Affected Validation

The following checks from `SignedBlock::validate` are bypassed:

- **Signature verification**: `signature.verify(header.commitment(), signer)` ensures the block header was actually signed by the claimed validator
- **Parent header consistency**: `header.prev_block_commitment() == parent.commitment()` ensures the block correctly links to the chain

## Impact

In `miden-node`, `rpc_sync.rs` deserializes blocks from upstream via `SignedBlock::read_from_bytes` and immediately applies them via `apply_block`. The `apply_block` path calls `validate_block_header`, which checks tx_commitment and block sequence, but **does not verify the signature**.

This means a compromised or malicious upstream node could feed a tampered `SignedBlock` that passes sequence checks but has an invalid or forged signature, and the syncing node would accept it.

## Contrast with ProposedBatch

`ProposedBatch::read_from` calls `new_batch_inner` during deserialization, ensuring all validation runs. `SignedBlock` should do the same with `validate`.

## Suggested Fix

Call `validate` (or an equivalent validation routine) in `SignedBlock::read_from`, or require callers to validate explicitly before `apply_block`.

## References

- `SignedBlock::read_from` (no validation): `crates/miden-protocol/src/block/signed_block.rs:206`
- `SignedBlock::validate` (signature check): `crates/miden-protocol/src/block/signed_block.rs:152`
- `apply_block` (no signature verify): `crates/miden-node/crates/store/src/state/apply_block.rs:101`
- `rpc_sync` (upstream deserialization): `crates/miden-node/crates/block-producer/src/rpc_sync.rs:142`

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.