flashbots / flashbots/flashtestations

QuoteParser ignores tcbStatus from Automata verification output

Open
#58 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Solidity
Stars
4
Forks
4
PR merge metrics
No merged PRs in 30d

Description

The `QuoteParser.parseV4VerifierOutput()` function skips over the `tcbStatus` byte without any validation.

**Location:** `src/utils/QuoteParser.sol:41-53`

```solidity
function parseV4VerifierOutput(bytes memory serializedOutput) internal pure returns (TD10ReportBody memory) {
checkTEEVersion(serializedOutput); // validates bytes 0-1
checkTEEType(serializedOutput); // validates bytes 2-5
// tcbStatus at byte 6 is never checked

return parseRawReportBody(serializedOutput.substring(SERIALIZED_OUTPUT_OFFSET, TD_REPORT10_LENGTH));
}
```

The byte layout (per line 23):
```
// 13 bytes = quoteVersion (2 bytes) + tee (4 byte) + tcbStatus (1 byte) + fmspcBytes (6 bytes)
```

**Impact:**

Attestations from TEEs with any `TCBStatus` value are accepted, including:
- `OutOfDate` - security updates available
- `ConfigurationNeeded` - configuration changes required
- `SWHardeningNeeded` - software hardening required
- `Revoked` - TCB revoked due to security vulnerabilities

**Suggested fix:**

Either:
1. Extract and validate `tcbStatus` in `parseV4VerifierOutput()`, rejecting non-OK statuses
2. Return `tcbStatus` alongside the `TD10ReportBody` so callers can enforce their own policy

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with src/utils/QuoteParser.sol:41-53 and the byte layout described near line 23, confirming how byte 6 is currently skipped. Determine whether the parser should reject non-OK tcbStatus values or return the status for caller policy. Done means tcbStatus is no longer silently ignored and the chosen behavior is covered by the relevant verification tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
solidity
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.