ethereum / ethereum/trinity-eth2
Beacon operation validation can raise `IndexError`s
- Dominant language
- Python
- Stars
- 16
- Forks
- 9
- PR merge metrics
- No merged PRs in 30d
Description
### What is wrong?
Several block operation validation functions can raise `IndexError` in addition to a `ValidationError` e.g. [`validate_voluntary_exit()`](https://github.com/ethereum/trinity/blob/84381f4fe19b18dddf2d2b210bd0780038728acd/eth2/beacon/state_machines/forks/serenity/block_validation.py#L482), [`validate_proposer_slashing()`](https://github.com/ethereum/trinity/blob/84381f4fe19b18dddf2d2b210bd0780038728acd/eth2/beacon/state_machines/forks/serenity/block_validation.py#L140) when passed an `Operation` with an invalid validator index.
It is not obvious whether this is a documentation issue (that `IndexError`s are an expected result), or a crash-causing bug and DOS vector:
- Test handlers have `IndexError` as an expected exception type: https://github.com/ethereum/trinity/blob/84381f4fe19b18dddf2d2b210bd0780038728acd/eth2/beacon/tools/fixtures/test_types/operations.py#L135-L146
- Block importing doesn't appear to handle `IndexError`s: https://github.com/ethereum/trinity/blob/84381f4fe19b18dddf2d2b210bd0780038728acd/trinity/sync/beacon/chain.py#L158
### How can it be fixed
Catch `IndexError`s immediately and wrap them with a `ValidationError`. This is clearer and avoids potential bugs from forgetting to catch `IndexError`s.
### How it was found
Discovered via [`beacon-fuzz`](https://github.com/sigp/beacon-fuzz/) (initial testing of [`proposer_slashing` fuzzer](https://github.com/sigp/beacon-fuzz/tree/add_targets/files/fuzzers/proposer_slashing)).
Triggering case: [proposer_slashing-crash-35a9d8e810ef1c20f057ee4e6aa8a927dc2ed6dc](https://drive.google.com/file/d/17Zct2ozCvQA2wlmdPYNb1wETZr-gRjIr/view?usp=sharing) with the following [`beacon_state`s](https://github.com/sigp/beacon-fuzz-corpora/tree/1c2d95a67a2136b94511908250e8b21d550a09d0/0-9-1/mainnet/beaconstate)
Or the pre-processed input [propslash_preprocessed_indexerror.ssz](https://drive.google.com/file/d/1g7Am3n58LSna3ffGYOWPDLSVo-alaQZH/view?usp=sharing) can be directly passed to the [trinity harness](https://github.com/sigp/beacon-fuzz/blob/add_targets/files/fuzzers/proposer_slashing/trinity/harness.py)
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.