Repository navigation
Conversation
Two related bridge safety defects: 1. ProcessClaim only rejected prophecies whose status was Failed. A prophecy in Success status still accepted claims from validators that had not voted yet; each of those transactions returned Success again and procEth2Chain33_lock / procEth2Chain33_burn re-ran ProcessSuccessfulClaimForLock (accDB.Mint) or the burn transfer, minting/paying the same cross-chain transfer repeatedly. 2. Prophecy IDs concatenated chainID, nonce, sender, token and claim type without separators, so (chainID=1,nonce=23) and (chainID=12,nonce=3) collided and unrelated cross-chain claims could poison each other. Behind ForkX2EthFixReplayCollisionNormalize: - Treat Success and Failed as terminal in ProcessClaim. - Build the prophecy ID with ':' separated fields via calcProphecyID, used by both oracle claim creation and the lock/burn handlers. - Update tests to derive prophecy ids with the same helper.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
问题
Oracle.ProcessClaim只拒绝Failed状态的 prophecy。已达Success的 prophecy 仍允许尚未投票的验证人继续提交相同 claim，processCompletion再次返回Success，procEth2Chain33_lock随即再次执行ProcessSuccessfulClaimForLock（accDB.Mint），burn 方向则重复从桥账户付款。按 70% 阈值，正常会有约 30% 验证人“迟到”；控制任一迟到验证人即可对同一笔跨链资产反复增发，验证人集变更后还能继续重复。chainID+nonce+sender+token+type直接拼接，(chainID=1,nonce=23)与(chainID=12,nonce=3)产生相同 ID；不同链的跨链 claim 会互相污染，可让合法 claim 命中已存在的 prophecy 被判Failed而资金卡死。修复
ForkX2EthFixReplayCollisionNormalize：ProcessClaim将Success/Failed都视为终态，后续投票直接拒绝；calcProphecyID，分叉后使用:分隔字段生成 ID，lock/burn 处理与 oracle claim 创建统一走该函数；验证
go build ./plugin/dapp/x2ethereum/...通过go test ./plugin/dapp/x2ethereum/executor/ -count=1通过（含原有 prophecy 套件）