Repository navigation
Reject Action Data With Bytes Left After the Arguments - #755
Conversation
A native action's data must hold exactly its struct: `action::data_as` fails with `action_data_and_struct_mismatch` when bytes are left over. The structs declare the optional fields the system contract adds, `memo` on `setcode` and `setabi` and `authorized_by` on `updateauth`, `deleteauth`, `linkauth` and `unlinkauth`, through a host `binary_extension` encoded as the CDT's. Packed context-free data fails with `tx_extra_data` when bytes follow its list. `sysio.wrap::exec` reads the whole wrapped transaction and fails when it carries transaction extensions or bytes follow it. Every system and test contract is rebuilt with the wire-cdt dispatcher that fails an action whose data holds bytes after its arguments. No system contract ABI changes. The deep-mind log and the consensus blockchain data are regenerated. Change-Id: I039b02881195e6b64c2a264eb94961ff74eb1145
huangminghuang
left a comment
huangminghuang
left a comment
There was a problem hiding this comment.
Reviewed the current diff and the native action, context-free-data, and wrap decoding paths. No actionable findings remain for the pre-launch scope.
Validation: focused base/head decoder probes, including valid optional extensions, and clangd checks. Full node and contract test suites were not run.
sysio.mechanics dispatches through SYSIO_DISPATCH, whose execute_action now checks only a contract's own actions, not the notifications routed through it. Change-Id: I1e42948586c4370669dc634652bd1c2e3eecab16
huangminghuang
left a comment
huangminghuang
left a comment
There was a problem hiding this comment.
Re-reviewed the current diff, including the sysmechanics WASM rebuild. No actionable findings for the pre-launch scope.
Validation: 14 direct WASM dispatcher cases across the previous and current artifacts passed, and the unchanged host-decoder probes were rerun. Full node and contract suites were not run locally.
The current-head Linux and macOS CI runs failed with GitHub Actions internal server errors before builds or tests started. Both complete workflows still need a successful rerun.
Every system and test contract is rebuilt with wire-cdt master. The deep-mind log and the consensus blockchain data are regenerated. `propose_rejects_bytes_after_transaction` now authorizes `propose` with the proposer's `sysio.payer` permission, which master requires. It moves above the delayed-proposal comment, which belongs to `propose_approve_execute_with_delay`. Change-Id: Ie4860c9dd1a4bdde6e88ea0d0222b5c16701d128
huangminghuang
left a comment
huangminghuang
left a comment
There was a problem hiding this comment.
Reviewed the current diff with OCR, including the master-merge resolution, removal of context-free actions, and multisig payer authorization. No actionable findings for the pre-launch scope.
Validation: fresh host-decoder probes and seven direct sysmechanics WASM dispatcher cases passed. The updated multisig regression tests compile. All 62 changed WASM modules validate and none import the removed context-free intrinsics. Clangd checks reported zero errors. Full node and contract suites were not run locally.
CI is still in progress: Ubuntu 24 completed its build and reached parallel tests; the other Linux and macOS builds are running.
Brings in #755. sysio.roa and sysio.system WASM are rebuilt from the merged sources with wire-cdt master (4de22afa), and sysio.limitauth_tests keeps both new tests.
sysio.synd and sysio.msgch are rebuilt with the wire-cdt master dispatcher that #755 adopted.
A native action's data must now hold exactly its struct.
action::data_asfails withaction_data_and_struct_mismatchwhen bytes are left over, which covers the native handlers and the authorization check of the permission actions.memoonsetcodeandsetabi, andauthorized_byonupdateauth,deleteauth,linkauthandunlinkauth. A new hostbinary_extension<T>encodes them as the CDT does, adding no bytes when absent.tx_extra_datawhen bytes follow its list. No bytes and the packed empty list (00, which@wireio/sdk-coresends) are both still accepted.sysio.wrap::execreads the whole wrapped transaction and fails when it carries transaction extensions or bytes follow it.Test contracts that read their action data raw declare an
ignore<>parameter, and inline sends to actions without arguments carry no data.Every system and test contract is rebuilt with the wire-cdt dispatcher from Wire-Network/wire-cdt#131, which fails an action whose data holds bytes after its arguments. No system contract ABI changes, so wire-libraries-ts needs nothing. The deep-mind log and the consensus blockchain data are regenerated; the snapshot compatibility fixture is unchanged and still passes.
Pairs with Wire-Network/wire-cdt#131. Merge them together. A release tag resolves the latest published wire-cdt release, so wire-cdt has to be released first.