ChainSafe / ChainSafe/forest

[Bug/Security] FVM "Executor" is vulnerable to stack overflow

Open
#3,226 4 comments 0 reactions 0 assignees View on GitHub
Priority: 4 - Low Type: Bug
Dominant language
Rust
Stars
697
Forks
200
Avg merge
1d 5h
Merged PRs (30d)
65

Description

**Describe the bug**

As mentioned to Guillaume yesterday during ETHCC, in Forest, you are using "Executor" instead of "ThreadedExecutor", the one used in Lotus. The main difference is that "Executor" can stack overflow if you have recursive sub-calls at actors execution.

We discover this behavior during fuzzing and later found out there is even a comment in the doc about that: https://github.com/filecoin-project/ref-fvm/blob/f4f3f340ba29b3800cd8272e34023606def23855/fvm/src/executor/default.rs#L29-L33

Based on discussions I got with Filecoin bug bounty program, your only solution is to switch to "ThreadedExecutor" since they rejected my proposal to add a stack depth protection and do not consider it a vulnerability in fvm.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.