dvf / dvf/blockchain

Brute force blockchain tampering via unchecked length field (whose validity is not checked during consensus) ; absent logging

Open
#90 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
8k
Forks
2.8k
PR merge metrics
No merged PRs in 30d

Description

see: https://github.com/dvf/blockchain/issues/50

The underlying exploit to tamper with a blockchain is described there

props to: @TimelessP

The fix should be fairly simple:
affected file: blockchain/blockchain.py

https://github.com/dvf/blockchain/blob/4010cf3273e19146a9cd7b37cf355cb751ffef88/blockchain.py#L82

A noted, currently it reads:

if length > max_length and self.valid_chain(chain):

@TimelessP suggests a change as follows:

if length > max_length and self.valid_chain(chain) and length == len(chain):

(and then of course the same fix needs to be applied to the C# code)

Additionally, be sure to log offending hosts.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.