Skip to content

fix(gravity): reject offline relayer confirmations#962

Open
jamilahmadzai wants to merge 1 commit into
openmetaearth:mainfrom
jamilahmadzai:fix/gravity-offline-relayer-confirms-940
Open

fix(gravity): reject offline relayer confirmations#962
jamilahmadzai wants to merge 1 commit into
openmetaearth:mainfrom
jamilahmadzai:fix/gravity-offline-relayer-confirms-940

Conversation

@jamilahmadzai

@jamilahmadzai jamilahmadzai commented Jun 6, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Reject ConfirmBatch and RelayerSetConfirm submissions when the relayer's stored record is offline.
  • Filter stored batch and relayer-set confirmation query results, including both list and specific-confirm endpoints, so offline relayer signatures are not returned as executable bridge material.
  • Add regression coverage for both confirmation message paths and for stale stored confirmation query results.
  • Keep TRON keeper test relayers active so the shared confirmation tests continue covering the successful active-relayer paths.

Root cause

confirmHandlerCommon loaded the relayer record and verified the external address and signature, but it did not enforce the same Online gate that claim handling already uses. That allowed a slashed/offline relayer to keep submitting valid external signatures for pending bridge work.

Validation

  • go test ./x/tron/keeper -run 'TestKeeperTestSuite/(TestQuery_BatchConfirms|Test_msgServer_ConfirmBatch|Test_msgServer_RelayerSetConfirm)' -count=1 -v
  • go test ./x/gravity/keeper -run 'TestGravityKeeperTestSuite/TestOfflineRelayer' -count=1 -v
  • go test ./x/gravity/keeper -run 'TestGravityKeeperTestSuite/Test(MsgSetRelayerSetConfirm|ClaimWithRelayerOnline|Keeper_DeleteBatchConfirm|LastPendingBatchRequestByAddr|QueryUnbatchedTxs)' -count=1 -v
  • go test ./x/tron/keeper ./x/gravity/keeper -count=1
  • git diff --check

Fixes #940

Meta Earth bug bounty payout: $MEC via ME Pass address me1ya82w6cjflk9r2qeyfeu64sm7gxtfr7mu62w9j.

@jamilahmadzai jamilahmadzai force-pushed the fix/gravity-offline-relayer-confirms-940 branch from 947e74d to 9a436ea Compare June 6, 2026 00:21
@koelzen koelzen added run-ci Trigger CI run and removed run-ci Trigger CI run labels Jun 10, 2026
@jamilahmadzai jamilahmadzai force-pushed the fix/gravity-offline-relayer-confirms-940 branch from 9a436ea to 9c82583 Compare June 18, 2026 14:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG BOUNTY] [High] [Gravity] Offline relayers can still submit batch and relayer-set confirmations

2 participants