Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixed bug in voting #2818

Closed
wants to merge 1 commit into from
Closed

Conversation

panleone
Copy link

@panleone panleone commented Mar 4, 2023

(For some Reason git closed the old PR while I was force pushing a new version.)

With the current system users can update their vote to a given proposal with the condition that the new vote is sent at least 1 hour after the old vote, this can lead to a possible vulnerability:

Let's consider the following scenario: a malicious node generates and propagates two votes (x,y), with x vote and y time stamp, to the same proposal for example A=(YES, 15:00) and B=(NO, 15:01).
What happens in this case to consensus? There are two possibilities:
If a node receive first the vote A and then the vote B it will accept A and reject B since the time difference is only one minute.
If a node receive first the vote B and then the vote A it will accept B and reject A since the time difference would be -1 minute.

Hence in this scenario nodes will not agree on final votes and this would lead to a fork at the superblock.

With this pull request I want to fix this vulnerability with the following:

  • Nodes will always accept and relay a new vote only if it is submitted at least in the next 1 hour slot
  • If the new vote is submitted in the same 1 hour slot of the old vote by convention we keep and relay the YES (relay only if the old vote was not YES to avoid spam)

Copy link
Member

@Liquid369 Liquid369 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tACK 1512dfa

I like this better than just before allowing if the vote is older than the last

@Fuzzbawls Fuzzbawls added this to the 6.0.0 milestone Apr 4, 2023
@panleone panleone closed this Feb 18, 2024
@panleone panleone removed this from the 6.0.0 milestone Feb 18, 2024
@panleone panleone removed their assignment Feb 18, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants