Impact
Possible consensus split given maliciously-crafted AttesterSlashing
or ProposerSlashing
being included on-chain.
Since we represent uint64
values as native javascript number
s, there is an issue when those variables with large (greater than 2^53) uint64
values are included on chain. In those cases, Lodestar may view valid AttesterSlashing
or ProposerSlashing
as invalid, due to rounding errors in large number
values. This causes a consensus split, where Lodestar nodes are forked away from the main network.
Similarly Lodestar may consider invalid ProposerSlashing
as valid, thus including in proposed blocks that will be considered invalid by the network.
Patches
https://github.com/ChainSafe/lodestar/pull/3977
Workarounds
Use BigInt
to represent Slot
and Epoch
values in AttesterSlashing
and ProposerSlashing
objects. BigInt
is too slow to be used in all Slot
and Epoch
cases, so we will carefully use BigInt
just where necessary for consensus.