fix(gravity): reject offline relayer confirmations#962
Open
jamilahmadzai wants to merge 1 commit into
Open
Conversation
947e74d to
9a436ea
Compare
9a436ea to
9c82583
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ConfirmBatchandRelayerSetConfirmsubmissions when the relayer's stored record is offline.Root cause
confirmHandlerCommonloaded the relayer record and verified the external address and signature, but it did not enforce the sameOnlinegate that claim handling already uses. That allowed a slashed/offline relayer to keep submitting valid external signatures for pending bridge work.Validation
go test ./x/tron/keeper -run 'TestKeeperTestSuite/(TestQuery_BatchConfirms|Test_msgServer_ConfirmBatch|Test_msgServer_RelayerSetConfirm)' -count=1 -vgo test ./x/gravity/keeper -run 'TestGravityKeeperTestSuite/TestOfflineRelayer' -count=1 -vgo test ./x/gravity/keeper -run 'TestGravityKeeperTestSuite/Test(MsgSetRelayerSetConfirm|ClaimWithRelayerOnline|Keeper_DeleteBatchConfirm|LastPendingBatchRequestByAddr|QueryUnbatchedTxs)' -count=1 -vgo test ./x/tron/keeper ./x/gravity/keeper -count=1git diff --checkFixes #940
Meta Earth bug bounty payout:
$MECvia ME Pass addressme1ya82w6cjflk9r2qeyfeu64sm7gxtfr7mu62w9j.