marigold-dev / marigold-dev/deku
Verify data integrity at the networking layer
Nobody has claimed this yet.
- Dominant language
- OCaml
- Stars
- 82
- Forks
- 17
- PR merge metrics
- No merged PRs in 30d
Description
It should not be possible to deserialize bad data into our domain-specific types.
For example, look at all the checking that we do around hash and payload hash here: https://github.com/marigold-dev/deku/blob/b2f6bc203409e16f4b786f019562691531fe07a7/src/protocol/block.ml#L6-L7
Forgetting to add checks in our deserialization functions is a real attack vector we should try to eliminate at the networking level.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading src/protocol/block.ml at lines 6-7, which is cited as an example of hash and payload-hash checks. Then identify the networking-layer deserialization functions and determine how domain-specific types are validated. Done means bad data cannot be deserialized into those types and the relevant validation is covered consistently.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ocaml
- Domain
- networking, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100