fix: tighten light-client zeroed-header checks to match spec#9419
Draft
ensi321 wants to merge 1 commit into
Draft
fix: tighten light-client zeroed-header checks to match spec#9419ensi321 wants to merge 1 commit into
ensi321 wants to merge 1 commit into
Conversation
…atch spec `isZeroedHeader` only compared `bodyRoot`, and `isZeroedSyncCommittee` only compared `pubkeys[0]`. The consensus-specs reference (`altair/light-client/sync-protocol.md` `process_light_client_update`) requires whole-struct equality against `LightClientHeader()` and `SyncCommittee()` respectively. The loose checks let a non-finality `LightClientUpdate` carry an attacker-controlled `finalizedHeader` (arbitrary slot/proposerIndex/parentRoot/stateRoot, only `bodyRoot=0`) past validation, and `processLightClientUpdate` would then overwrite `store.finalizedHeader` with it. Switch both helpers to full SSZ-struct equality, matching the spec. Also add an `isFinalityUpdate(update)` guard on the `store.finalizedHeader` write site in `processLightClientUpdate` as defense-in-depth, so a non-finality update can never reach the overwrite branch regardless of any future regression in the zero checks. In-tree impact is limited: the light-client consumer was extracted to an external repo in #9346, and the in-repo callers of this code are the spec-test runner and downstream importers of `@lodestar/state-transition/light-client`. The published package surface still exposes the bug to any consumer that runs `validateLightClientUpdate` / `LightclientSpec` against untrusted updates. AI Assistance Disclosure: drafted with Claude (claude-opus-4-7). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
ensi321
changed the title
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request improves the security and spec-compliance of the light client update processing. It adds a defense-in-depth check isFinalityUpdate(update) when updating the finalized header. Additionally, it strengthens isZeroedHeader and isZeroedSyncCommittee by performing full equality checks against zeroed structures instead of partial checks, preventing potential exploits where arbitrary data could be smuggled. There are no review comments, so I have no feedback to provide.
Contributor
Performance Report✔️ no performance regression detected Full benchmark results
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
isZeroedHeader(packages/state-transition/src/lightClient/spec/utils.ts:108) only checkedbodyRoot; spec (altair/light-client/sync-protocol.mdprocess_light_client_update) requires whole-struct equality againstLightClientHeader(). Same loosening present inisZeroedSyncCommittee. Switched both to full SSZ-struct equality.isFinalityUpdate(update)guard at thestore.finalizedHeaderwrite site inprocessLightClientUpdateas defense-in-depth.ZERO_PUBKEYexport.Background
A reporter flagged that the loose
isZeroedHeadercheck allows a non-finalityLightClientUpdateto carry an attacker-controlledfinalizedHeader(arbitrary slot/proposerIndex/parentRoot/stateRoot, onlybodyRoot=0) pastvalidateLightClientUpdate.processLightClientUpdate.ts:47-51then overwritesstore.finalizedHeaderwith it, since the conditional was gated only on the 2/3 sync-committee threshold and a higher slot — not onisFinalityUpdate(update). A MITM or malicious beacon-API endpoint could thus point a connected light client at any attacker-chosen state root.AI Assistance Disclosure
Drafted with Claude (
claude-opus-4-7).🤖 Generated with Claude Code