emails/New finding_ malformed txns never leave mempool (1).eml

Received-SPF: pass (google.com: domain of mo@amulet.dev designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41;
MIME-Version: 1.0
References: <CAK5+0FT48fsLMDSi8uQLfTiy9N0-UOBYtUhfSFVQhyQ+i2vwag@mail.gmail.com>
In-Reply-To: <CAK5+0FT48fsLMDSi8uQLfTiy9N0-UOBYtUhfSFVQhyQ+i2vwag@mail.gmail.com>
From: Moshe Mizrahi <mo@amulet.dev>
Date: Sun, 8 Oct 2023 00:02:25 -0700
Message-ID: <CAGYWHoasmYsbvQwisqz+m4YMZEaeucyPUfqGn1uDaz7fbRUKoQ@mail.gmail.com>
Subject: Re: New finding: malformed txns never leave mempool
To: Jacob Gadikian <jacob@notional.ventures>
Cc: security@interchain.io
Content-Type: multipart/alternative; boundary="000000000000fc755906072f0eae"

--000000000000fc755906072f0eae
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hey Jacob,

Thank you for the additional context. I=E2=80=99ll make sure it is included=
 in the
triage.

Thanks,
Mo

On Sat, Oct 7, 2023 at 11:27=E2=80=AFPM Jacob Gadikian <jacob@notional.vent=
ures>
wrote:

>
> I realize that in the present state people aren't actually in the habit o=
f
> looking at the repository that we created, but if you see in there there'=
s
> a file called mempoolcryptocrew.json.
>
> That contains these, I think.
>
> In order to understand the attack I strongly recommend running it.
>
> Below are Joe's findings
>
> ```
>
> @Jacob Gadikian another (albeit reasonably minor) bug - note untested,
> just from reading the mempool code:
>
> Notably, the both of these values (checkTx and txPreFilter) use the raw
> value of MaxBytes, but should - for correctness - use types.MaxDataBytes(=
)
> to ensure the total block size remains within the correct bounds. Failure
> to use the correct value allows a malicious actor to fill a network's
> mempool with transactions of size `types.MaxDataBytes > x > MaxBytes` whi=
ch
> can never be delivered (as they will never be picked up by ReapMaxTxBytes=
 -
> which does use the correct value),.
>
> ```
>
>
>

--000000000000fc755906072f0eae
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto">Hey Jacob,</div><div dir=3D"auto"><br></div><div dir=3D"a=
uto">Thank you for the additional context. I=E2=80=99ll make sure it is inc=
luded in the triage. =C2=A0</div><div dir=3D"auto"><br></div><div dir=3D"au=
to">Thanks,=C2=A0</div><div dir=3D"auto">Mo</div><div><br><div class=3D"gma=
il_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Sat, Oct 7, 2023 at 11:2=
7=E2=80=AFPM Jacob Gadikian &lt;jacob@notional.ventures&gt; wrote:<br></div=
><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1=
px #ccc solid;padding-left:1ex"><div dir=3D"auto"><div dir=3D"auto"><br></d=
iv><div dir=3D"auto">I realize that in the present state people aren&#39;t =
actually in the habit of looking at the repository that we created, but if =
you see in there there&#39;s a file called mempoolcryptocrew.json.=C2=A0</d=
iv><div dir=3D"auto"><br></div><div dir=3D"auto">That contains these, I thi=
nk.=C2=A0</div><div dir=3D"auto"><br></div><div dir=3D"auto">In order to un=
derstand the attack I strongly recommend running it.</div><div dir=3D"auto"=
><br></div><div dir=3D"auto">Below are Joe&#39;s findings</div><div dir=3D"=
auto"><br></div><div dir=3D"auto">```</div><div dir=3D"auto"><br></div>@Jac=
ob Gadikian another (albeit reasonably minor) bug - note untested, just fro=
m reading the mempool code:<div dir=3D"auto"><br></div><div dir=3D"auto">No=
tably, the both of these values (checkTx and txPreFilter) use the raw value=
 of MaxBytes, but should - for correctness - use types.MaxDataBytes() to en=
sure the total block size remains within the correct bounds. Failure to use=
 the correct value allows a malicious actor to fill a network&#39;s mempool=
 with transactions of size `types.MaxDataBytes &gt; x &gt; MaxBytes` which =
can never be delivered (as they will never be picked up by ReapMaxTxBytes -=
 which does use the correct value),.</div><div dir=3D"auto"><br></div><div =
dir=3D"auto">```</div><div dir=3D"auto"><br></div><div dir=3D"auto"><br></d=
iv></div>
</blockquote></div></div>

--000000000000fc755906072f0eae--