bug(rust-client): panic when get_account proof omits public account details
- 主要言語
- Rust
- スター
- 78
- フォーク
- 129
- 平均マージ
- 4日 14時間
- マージ済み PR(30日)
- 52
説明
## Summary
During public account sync, `StateSync::validate_account_proof` panics if the RPC `get_account` proof contains no account details. A malformed, buggy, or malicious node response can crash the client instead of returning a chain validation error.
This is not a normal happy-path logic bug, but it is a real client crash / DoS issue on untrusted RPC input.
## Location
`crates/rust-client/src/sync/state_sync.rs`
```rust
Ok(details.expect("node returned no details for a public account"))
```
## Expected behavior
Missing details should return `ClientError::ChainValidationError`, consistent with the other validation failures in the same function.
## Actual behavior
The client panics during `sync_state` while syncing a public account.
## Why this is reachable
The RPC conversion layer already allows `details` to be missing:
```rust
// crates/rust-client/src/rpc/domain/account.rs
let details: Option = match account_proof.details {
None => None,
Some(details) => Some(...),
};
AccountProof::new(witness.try_into()?, details)
```
So `None` is representable end-to-end, but `validate_account_proof` treats it as an invariant and panics.
## Impact
- Client crash during sync on bad RPC data
- Harder to diagnose than a structured validation error
- Same class of issue as malformed block header handling (#2378 / #2379)
## Proposed fix
Replace the `expect` with an explicit error, e.g.:
```rust
details.ok_or_else(|| ClientError::ChainValidationError(format!(
"get_account returned no details for public account {account_id}"
)))?
```
Add a unit test that passes an `AccountProof` with `details: None` and asserts `ChainValidationError` is returned.
## Scope
Small `rust-client` change. No store/protocol changes expected.
コントリビューションガイド
調査の方向性
The bug is in crates/rust-client/src/sync/state_sync.rs in the validate_account_proof function. Start by reading the function and the surrounding sync logic. The fix is to replace the .expect() call with an error return as described. Write a unit test that creates an AccountProof with details: None and calls validate_account_proof to ensure it returns a ChainValidationError. Run the existing tests to confirm your change doesn't break anything.
索引モデルが issue の本文から書いたものです。
評価
- 技術スタック
- rust
- 領域
- backend
- issue の種類
- バグ
- 難易度
- 2/5
- 見積もり時間
- 1〜3時間
- 活発さ
- 活発
- 明瞭さ
- 明確に書かれている
- 初心者へのやさしさ
- 75/100