Buffer Overflow Affecting @chainsafe/lodestar Open this link in a new tab package, versions <0.36.0


0.0
high
  • Attack Complexity

    Low

  • Integrity

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    SNYK-JS-CHAINSAFELODESTAR-2847914

  • published

    25 May 2022

  • disclosed

    24 May 2022

  • credit

    Unknown

How to fix?

Upgrade @chainsafe/lodestar to version 0.36.0 or higher.

Overview

@chainsafe/lodestar is an A Typescript implementation of the beacon chain

Affected versions of this package are vulnerable to Buffer Overflow. Possible consensus split given maliciously-crafted AttesterSlashing or ProposerSlashing being included on-chain.

The library represents uint64 values as native javascript numbers, causing an issue when those variables with large (greater than 2^53) uint64 values are included on chain. In those cases, Lodestar may view _valid_ AttesterSlashing or ProposerSlashing as _invalid_, due to rounding errors in large number values. This causes a consensus split, where Lodestar nodes are forked away from the main network.

Similarly Lodestar may consider _invalid_ ProposerSlashing as _valid_, thus including in proposed blocks that will be considered invalid by the network.

Workarounds

Use BigInt to represent Slot and Epoch values in AttesterSlashing and ProposerSlashing objects. BigInt is too slow to be used in all Slot and Epoch cases, so use BigInt only when necessary for consensus.

References