5 ms·
> I'll also try to point out more explicitly which parts I think are not secure. Things I've noticed: * Use of floating point arithmetic. * Non-reproducible
by magnat 9y ago
> I'll also try to point out more explicitly which parts I think are not secure.
Things I've noticed:
* Use of floating point arithmetic.
* Non-reproducible serialization in verify_transaction can produce slightly different, but equivalent JSON, which leads to rejecting transactions if produced JSON is platform-dependent (e.g. CRLFs, spaces vs tabs).
* Miners can perform DoS by creating a pair of blocks referencing each other (recursive call in verify_block is made before any sanity checks or hash checks, so they can modify block's ancestor without worrying about changing its hash).
* mine method can loop forever due to integer overflow.
* Miners can put in block a transaction with output sum greater than input sum - only place where it is checked is in compute_fee and no path from verify_block leads there.
- jre 9y agoThose are all very good points I didn't think about, thanks for these. I'll fix the two bugs with verify_block and the possibility for a miner to inject invalid a output > input transaction. I'll add a note for the 3 others.
- westurner 9y agoFor deterministic serialization (~canonicalization), you can use sort_keys=True or serialize OrderedDicts. For deseialization, you'd need object_pairs_hook=collections.OrderedDict. Most current blockchains sign a binary representation with fixed length fields. In terms of JSON, JSON-LD is for graphs and it can be canonicalized. Blockcerts and Chainpoint are JSON-LD specs: > Blockcerts uses the Verifiable Claims MerkleProof2017 signature format, which is based on Chainpoint 2.0. https://github.com/blockchain-certificates/cert-verifier-js/blob/master/README.md#check-certificate-integrity https://github.com/blockchain-certificates/cert-verifier-js/...
- Cyph0n 9y agoFYI, dicts are now ordered by default as of Python 3.6.
- cpburns2009 9y agoThat's an implementation detail, and shouldn't be relied upon. If you want an ordered dictionary, you should use collections.OrderedDict.
- Cyph0n 9y agoTrue, but if you need both key ordering and performance, dict is the better option.
- westurner 9y agoIt's now the spec for 3.6+. > #python news: @gvanrossum just pronounced that dicts are now guaranteed to retain insertion order. This is the end of a long journey. https://twitter.com/raymondh/status/941709626545864704 https://twitter.com/raymondh/status/941709626545864704 More here: https://www.reddit.com/r/Python/comments/7jyluw/dict_knownordered_versus_ordereddict_an/ https://www.reddit.com/r/Python/comments/7jyluw/dict_knownor... OrderedDicts are backwards-compatible and are guaranteed to maintain order after deletion.