Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bug: pre-verification of proofs can DoS the batcher #1744

Open
Oppen opened this issue Jan 16, 2025 · 0 comments
Open

bug: pre-verification of proofs can DoS the batcher #1744

Oppen opened this issue Jan 16, 2025 · 0 comments
Labels
audit batcher issues within aligned-batcher cantina Audit report from Cantina

Comments

@Oppen
Copy link
Collaborator

Oppen commented Jan 16, 2025

From cantina issue #45. Transcript of description:

Batcher service's can be DoSed as in proof submission pipeline computationally expensive ZK proof verification is performed before any user validation checks.

Currently in handle_submit_proof_msg in aligned-batcher/src/lib.rs, the sequence of operations are

Basic message validation (chain ID, service address, signature)
ZK proof verification (expensive) if pre-verification is enabled (which is enabled by default)
User balance/ nonce checks
This sequence allows malicious actors to:

Submit arbitrarily many proofs without having sufficient locked funds
Force the batcher to perform expensive ZK proof verification
Consume significant CPU and Memory resources at no cost
Degrade/ deny service to legitimate users

We need to move that verification to the last step before accepting a batch, after balance checks.
We may also need to use some queue to limit parallel proofs being verified to avoid unbounded memory use.
Finding a way of charging for this may also help.

@Oppen Oppen added audit batcher issues within aligned-batcher cantina Audit report from Cantina labels Jan 16, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
audit batcher issues within aligned-batcher cantina Audit report from Cantina
Projects
None yet
Development

No branches or pull requests

1 participant