3 ms·
The actual exploit (simplified for brevity): if (validSignature == signatureFromGuardian) approve() If you send an invalid signature from a non-gu
by dannyw 5y ago
The actual exploit (simplified for brevity):
if (validSignature == signatureFromGuardian)
approve()
If you send an invalid signature from a non-guardian, the condition also resolves to true.
- civilized 5y agoMaybe I'm having a dumb day here but I'm not following... is the code block there the intended behavior or the exploit? In the case you mention, both conditions are false...
- dannyw 5y agoApologies, == instead of &&. false == false
- chairmanwow1 5y agoCan you link to the code. This seems bizarre to me that someone would write it this way.
- ajross 5y agoMicrobugs always look like that. Weird stuff pops out of our brains when transcribing ideas about rules into logic. The overwhelming majority of such thinkos are clearly wrong and don't work, or often even build. And sometimes you get bugs that take a while to find because the case where it would fail is an untested edge case. And then, once in a while, one of those edge cases...
- emerged 5y agoThe longer it takes to find the cause of a bug, the more likely the bug is a thinko.
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- theli0nheart 5y ago> If you send an invalid signature from a non-guardian, the condition also resolves to true. Huh? That resolves to false && false, which equals false.
- bvanheu 5y agoI think dannyw meant something like this: # This function is defined by the system def validSignature(sig): return false # This function is defined by the system def isSignaturefromGuardian(sig): if sig.validator == "guardian": return true return false # A bug in the system compared both return values if validSignature(tx.sig) == signatureFromGuardian(tx.sig): approve() ```
- civilized 5y agoI looked at your post, then at these Twitter threads recommended in the other comments https://news.ycombinator.com/item?id=30187898 https://news.ycombinator.com/item?id=30187898 I think "something about not checking signatures right" is about as deep as I'm going to understand this.
- PretzelPirate 5y agoThere is a parameter passed in as part of a function call that basically says “here’s where you can find the function to validate the signature”. The attacker was able to point that to a function they wrote instead of using the real one, so the function returned saying “yep, that’s a valid signature” when it wasn’t.
- Ansil849 5y agoI understand the first part, "There is a parameter passed in as part of a function call that basically says “here’s where you can find the function to validate the signature", but I'm having trouble understanding the second part, "The attacker was able to point that to a function they wrote instead of using the real one". In other words I (relatively) understand the 'what', but I don't understand how was the attacker able to do the redirect?
- civilized 5y agoSomething something system addresses.
- mewse 5y agoWait.. are you saying that the conditional was actually: if (isSignatureValid == isSignatureFromGuardian) As variable names, “validSignature” and “signatureFromGuardian” sound like they’re storing the literal signature values, but from your description these are actually holding boolean results _describing_ the signatures, and not the signatures themselves? Geez, if you name variables that it’d be amazingly easy to make a mistakes like what you describe, and then just read straight over them when you’re reviewing the code.