0xMiden / 0xMiden/rust-sdk

bug(rust-client): panic when get_account proof omits public account details

オープン 初心者向け
#2,386 コメント 2 件 リアクション 0 件 担当者 0 名 GitHub で見る
主要言語
Rust
スター
78
フォーク
129
平均マージ
4日 14時間
マージ済み PR(30日)
52

説明

## Summary

During public account sync, `StateSync::validate_account_proof` panics if the RPC `get_account` proof contains no account details. A malformed, buggy, or malicious node response can crash the client instead of returning a chain validation error.

This is not a normal happy-path logic bug, but it is a real client crash / DoS issue on untrusted RPC input.

## Location

`crates/rust-client/src/sync/state_sync.rs`

```rust
Ok(details.expect("node returned no details for a public account"))
```

## Expected behavior

Missing details should return `ClientError::ChainValidationError`, consistent with the other validation failures in the same function.

## Actual behavior

The client panics during `sync_state` while syncing a public account.

## Why this is reachable

The RPC conversion layer already allows `details` to be missing:

```rust
// crates/rust-client/src/rpc/domain/account.rs
let details: Option = match account_proof.details {
None => None,
Some(details) => Some(...),
};
AccountProof::new(witness.try_into()?, details)
```

So `None` is representable end-to-end, but `validate_account_proof` treats it as an invariant and panics.

## Impact

- Client crash during sync on bad RPC data
- Harder to diagnose than a structured validation error
- Same class of issue as malformed block header handling (#2378 / #2379)

## Proposed fix

Replace the `expect` with an explicit error, e.g.:

```rust
details.ok_or_else(|| ClientError::ChainValidationError(format!(
"get_account returned no details for public account {account_id}"
)))?
```

Add a unit test that passes an `AccountProof` with `details: None` and asserts `ChainValidationError` is returned.

## Scope

Small `rust-client` change. No store/protocol changes expected.

コントリビューションガイド

コントリビューションガイドを開く

調査の方向性

The bug is in crates/rust-client/src/sync/state_sync.rs in the validate_account_proof function. Start by reading the function and the surrounding sync logic. The fix is to replace the .expect() call with an error return as described. Write a unit test that creates an AccountProof with details: None and calls validate_account_proof to ensure it returns a ChainValidationError. Run the existing tests to confirm your change doesn't break anything.

索引モデルが issue の本文から書いたものです。

評価

技術スタック
rust
領域
backend
issue の種類
バグ
難易度
2/5
見積もり時間
1〜3時間
活発さ
活発
明瞭さ
明確に書かれている
初心者へのやさしさ
75/100

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。