pallet-ethereum

Impact

Previously, the worst case weight was always accounted as the block weight for all cases. In case of large EVM gas refunds, this can lead to block spamming attacks -- the adversary can construct blocks with transactions that have large amount of refunds or unused gases with reverts, and as a result inflate up the chain gas prices. This issue is fixed by properly refund unused weights after each EVM execution.

The impact of this issue is limited in that the spamming attack would still be costly for any adversary, and it has no ability to alter any chain state.

Patches

The issue is fixed in https://github.com/paritytech/frontier/pull/851

Workarounds

None.

References

Are there any links users can visit to find out more?

For more information

If you have any questions or comments about this advisory:

• Open an issue in Frontier repo
• Email Wei

Impact

In the newly introduced signed Frontier-specific extrinsic for pallet-ethereum, a large part of transaction validation logic was only called in transaction pool validation, but not in block execution. Malicious validators can take advantage of this to put invalid transactions into a block.

The attack is limited in that the signature is always validated, and the majority of the validation is done again in the subsequent pallet-evm execution logic. However, do note that a chain ID replay attack was possible. In addition, spamming attacks are of main concerns, while they are limited by Substrate block size limits and other factors.

Patches

The issue is patched in commit 146bb48849e5393004be5c88beefe76fdf009aba.

References

Patch PR: https://github.com/paritytech/frontier/pull/495

For more information

If you have any questions or comments about this advisory:

• Open an issue in Frontier repo

Special thanks

Special thanks to @librelois, @nanocryk and the Moonbeam team for reporting and fixing this security vulnerability.

Impact

A bug in pallet-ethereum can cause invalid transactions to be included in the Ethereum block state in pallet-ethereum due to not validating the input data size. Any invalid transactions included this way have no possibility to alter the internal Ethereum or Substrate state. The transaction will appear to have be included, but is of no effect as it is rejected by the EVM engine. The impact is further limited by Substrate extrinsic size constraints.

Patches

Patches are applied in PR #465.

Workarounds

None.

References

Patch PR: https://github.com/paritytech/frontier/pull/465

For more information

If you have any questions or comments about this advisory:

• Open an issue in the Frontier repo

Impact

Previously, the worst case weight was always accounted as the block weight for all cases. In case of large EVM gas refunds, this can lead to block spamming attacks -- the adversary can construct blocks with transactions that have large amount of refunds or unused gases with reverts, and as a result inflate up the chain gas prices. This issue is fixed by properly refund unused weights after each EVM execution.

The impact of this issue is limited in that the spamming attack would still be costly for any adversary, and it has no ability to alter any chain state.

Patches

The issue is fixed in https://github.com/paritytech/frontier/pull/851

Workarounds

None.

References

Are there any links users can visit to find out more?

For more information

If you have any questions or comments about this advisory:

• Open an issue in Frontier repo
• Email Wei

Impact

In the newly introduced signed Frontier-specific extrinsic for pallet-ethereum, a large part of transaction validation logic was only called in transaction pool validation, but not in block execution. Malicious validators can take advantage of this to put invalid transactions into a block.

The attack is limited in that the signature is always validated, and the majority of the validation is done again in the subsequent pallet-evm execution logic. However, do note that a chain ID replay attack was possible. In addition, spamming attacks are of main concerns, while they are limited by Substrate block size limits and other factors.

Patches

The issue is patched in commit 146bb48849e5393004be5c88beefe76fdf009aba.

References

Patch PR: https://github.com/paritytech/frontier/pull/495

For more information

If you have any questions or comments about this advisory:

• Open an issue in Frontier repo

Special thanks

Special thanks to @librelois, @nanocryk and the Moonbeam team for reporting and fixing this security vulnerability.

Impact

A bug in pallet-ethereum can cause invalid transactions to be included in the Ethereum block state in pallet-ethereum due to not validating the input data size. Any invalid transactions included this way have no possibility to alter the internal Ethereum or Substrate state. The transaction will appear to have be included, but is of no effect as it is rejected by the EVM engine. The impact is further limited by Substrate extrinsic size constraints.

Patches

Patches are applied in PR #465.

Workarounds

None.

References

Patch PR: https://github.com/paritytech/frontier/pull/465

For more information

If you have any questions or comments about this advisory:

• Open an issue in the Frontier repo

Impact

Previously, the worst case weight was always accounted as the block weight for all cases. In case of large EVM gas refunds, this can lead to block spamming attacks -- the adversary can construct blocks with transactions that have large amount of refunds or unused gases with reverts, and as a result inflate up the chain gas prices. This issue is fixed by properly refund unused weights after each EVM execution.

The impact of this issue is limited in that the spamming attack would still be costly for any adversary, and it has no ability to alter any chain state.

Patches

The issue is fixed in https://github.com/paritytech/frontier/pull/851

Workarounds

None.

References

Are there any links users can visit to find out more?

For more information

If you have any questions or comments about this advisory:

• Open an issue in Frontier repo
• Email Wei

Impact

In the newly introduced signed Frontier-specific extrinsic for pallet-ethereum, a large part of transaction validation logic was only called in transaction pool validation, but not in block execution. Malicious validators can take advantage of this to put invalid transactions into a block.

The attack is limited in that the signature is always validated, and the majority of the validation is done again in the subsequent pallet-evm execution logic. However, do note that a chain ID replay attack was possible. In addition, spamming attacks are of main concerns, while they are limited by Substrate block size limits and other factors.

Patches

The issue is patched in commit 146bb48849e5393004be5c88beefe76fdf009aba.

References

Patch PR: https://github.com/paritytech/frontier/pull/495

For more information

If you have any questions or comments about this advisory:

• Open an issue in Frontier repo

Special thanks

Special thanks to @librelois, @nanocryk and the Moonbeam team for reporting and fixing this security vulnerability.

Impact

A bug in pallet-ethereum can cause invalid transactions to be included in the Ethereum block state in pallet-ethereum due to not validating the input data size. Any invalid transactions included this way have no possibility to alter the internal Ethereum or Substrate state. The transaction will appear to have be included, but is of no effect as it is rejected by the EVM engine. The impact is further limited by Substrate extrinsic size constraints.

Patches

Patches are applied in PR #465.

Workarounds

None.

References

Patch PR: https://github.com/paritytech/frontier/pull/465

For more information

If you have any questions or comments about this advisory:

• Open an issue in the Frontier repo

Impact

Previously, the worst case weight was always accounted as the block weight for all cases. In case of large EVM gas refunds, this can lead to block spamming attacks -- the adversary can construct blocks with transactions that have large amount of refunds or unused gases with reverts, and as a result inflate up the chain gas prices. This issue is fixed by properly refund unused weights after each EVM execution.

The impact of this issue is limited in that the spamming attack would still be costly for any adversary, and it has no ability to alter any chain state.

Patches

The issue is fixed in https://github.com/paritytech/frontier/pull/851

Workarounds

None.

References

Are there any links users can visit to find out more?

For more information

If you have any questions or comments about this advisory:

• Open an issue in Frontier repo
• Email Wei

Impact

In the newly introduced signed Frontier-specific extrinsic for pallet-ethereum, a large part of transaction validation logic was only called in transaction pool validation, but not in block execution. Malicious validators can take advantage of this to put invalid transactions into a block.

The attack is limited in that the signature is always validated, and the majority of the validation is done again in the subsequent pallet-evm execution logic. However, do note that a chain ID replay attack was possible. In addition, spamming attacks are of main concerns, while they are limited by Substrate block size limits and other factors.

Patches

The issue is patched in commit 146bb48849e5393004be5c88beefe76fdf009aba.

References

Patch PR: https://github.com/paritytech/frontier/pull/495

For more information

If you have any questions or comments about this advisory:

• Open an issue in Frontier repo

Special thanks

Special thanks to @librelois, @nanocryk and the Moonbeam team for reporting and fixing this security vulnerability.

Impact

A bug in pallet-ethereum can cause invalid transactions to be included in the Ethereum block state in pallet-ethereum due to not validating the input data size. Any invalid transactions included this way have no possibility to alter the internal Ethereum or Substrate state. The transaction will appear to have be included, but is of no effect as it is rejected by the EVM engine. The impact is further limited by Substrate extrinsic size constraints.

Patches

Patches are applied in PR #465.

Workarounds

None.

References

Patch PR: https://github.com/paritytech/frontier/pull/465

For more information

If you have any questions or comments about this advisory:

• Open an issue in the Frontier repo