Homepage
About Snyk

@chainsafe/lodestar@0.24.3-next.bbd055d505df55c4a0a96988220377053a903ae1.0 vulnerabilities

Command line interface for lodestar

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the @chainsafe/lodestar package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Buffer Overflow

@chainsafe/lodestar is an A Typescript implementation of the beacon chain

Affected versions of this package are vulnerable to Buffer Overflow. Possible consensus split given maliciously-crafted AttesterSlashing or ProposerSlashing being included on-chain.

The library represents uint64 values as native javascript numbers, causing an issue when those variables with large (greater than 2^53) uint64 values are included on chain. In those cases, Lodestar may view _valid_ AttesterSlashing or ProposerSlashing as _invalid_, due to rounding errors in large number values. This causes a consensus split, where Lodestar nodes are forked away from the main network.

Similarly Lodestar may consider _invalid_ ProposerSlashing as _valid_, thus including in proposed blocks that will be considered invalid by the network.

Workarounds

Use BigInt to represent Slot and Epoch values in AttesterSlashing and ProposerSlashing objects. BigInt is too slow to be used in all Slot and Epoch cases, so use BigInt only when necessary for consensus.

How to fix Buffer Overflow?

Upgrade @chainsafe/lodestar to version 0.36.0 or higher.

<0.36.0
Go back to all versions of this package