Homepage

@chainsafe/lodestar/.../lodestar@0.24.3-next.bbd055d505df55c4a0a96988220377053a903ae1.0 vulnerabilities

Command line interface for lodestar

  • latest version

    1.23.1

  • latest non vulnerable version

    1.24.0-rc.0

  • first published

    4 years ago

  • latest version published

    11 days ago

  • licenses detected

  • View lodestar package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @chainsafe/lodestar package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Buffer Overflow

    @chainsafe/lodestar is an A Typescript implementation of the beacon chain

    Affected versions of this package are vulnerable to Buffer Overflow. Possible consensus split given maliciously-crafted AttesterSlashing or ProposerSlashing being included on-chain.

    The library represents uint64 values as native javascript numbers, causing an issue when those variables with large (greater than 2^53) uint64 values are included on chain. In those cases, Lodestar may view _valid_ AttesterSlashing or ProposerSlashing as _invalid_, due to rounding errors in large number values. This causes a consensus split, where Lodestar nodes are forked away from the main network.

    Similarly Lodestar may consider _invalid_ ProposerSlashing as _valid_, thus including in proposed blocks that will be considered invalid by the network.

    Workarounds

    Use BigInt to represent Slot and Epoch values in AttesterSlashing and ProposerSlashing objects. BigInt is too slow to be used in all Slot and Epoch cases, so use BigInt only when necessary for consensus.

    How to fix Buffer Overflow?

    Upgrade @chainsafe/lodestar to version 0.36.0 or higher.

    <0.36.0
    Go back to all versions of this package