fix(electrum): bdk_electrum exploit fixes
#1675
Draft
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
LagginTimes
changed the title
bdk_electrum exploit fixes draftbdk_electrum exploit fixes
LagginTimes
force-pushed
the
electrum_exploit_fixes
branch
3 times, most recently
from
4c62df8
to
d7eac3e
Compare
LagginTimes
force-pushed
the
electrum_exploit_fixes
branch
from
9370150
to
4d0af70
Compare
LagginTimes
force-pushed
the
electrum_exploit_fixes
branch
from
4d0af70
to
721bae4
Compare
…sactions \`fetch_prev_txout\` should not try to query the prevouts of coinbase transactions, as it may result in the Electrum server returning an error which would cause the overall `sync` to fail.
This fix validates the coinbase merkle path when checking the merkle proof of a transaction we are inserting within the same block. This check mitigates a known brute force exploit that could insert an invalid transaction. f
LagginTimes
force-pushed
the
electrum_exploit_fixes
branch
2 times, most recently
from
371dbed
to
ba7e5cc
Compare
LagginTimes
force-pushed
the
electrum_exploit_fixes
branch
from
ba7e5cc
to
f4be0d0
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #1698, #1697.
Description
The aim of this PR is to fix a few exploits that were found within
bdk_electrum. Most notably:populate_with_txidsby returning a transaction with no output.fetch_prev_txoutshould not try to query the prevouts of coinbase transactions. This will query a transaction to the Electrum server which will return an error and will make the overallsyncfail.Notes to the reviewers
rust-electrum-clientPR: feat: addid_from_possupport rust-electrum-client#155MockElectrumClientintobdk_testenv, but becausebdk_testenv'selectrum-clientis re-exported fromelectrsd, a separate dependency would have to be added for justelectrum-clientas such that support fortxid_with_poswill be available when PR#155 is merged. Or perhaps there is a better way to specifically testvalidate_merkle_for_anchorthat does not involve creating aMockElectrumClient.Changelog notice
TODO
Checklists
All Submissions:
cargo fmtandcargo clippybefore committingNew Features:
Bugfixes: