|
| 1 | +//! Regression tests for GHSA-6gwf-frh8-ppw7. |
| 2 | +//! |
| 3 | +//! Before the fix, a single validator (n=1) could drain the bridge reserve |
| 4 | +//! because the dynamic quorum `ceil(2n/3)` collapses to 1 when n=1. These |
| 5 | +//! tests lock in the two floors that close the exploit: |
| 6 | +//! |
| 7 | +//! - `MIN_BRIDGE_VALIDATORS`: refuse releases when the active set is too small. |
| 8 | +//! - `MIN_BRIDGE_QUORUM`: floor on the number of distinct validator votes |
| 9 | +//! required, independent of active-set size. |
| 10 | +
|
| 11 | +use ultradag_coin::{ |
| 12 | + StateEngine, SecretKey, |
| 13 | + tx::{BridgeDepositTx, StakeTx, MIN_STAKE_SATS}, |
| 14 | + tx::bridge::BridgeReleaseTx, |
| 15 | + address::Signature, |
| 16 | + constants::{COIN, MIN_BRIDGE_QUORUM, MIN_BRIDGE_VALIDATORS, SUPPORTED_BRIDGE_CHAIN_IDS}, |
| 17 | +}; |
| 18 | + |
| 19 | +fn signed_stake(sk: &SecretKey, amount: u64, nonce: u64) -> StakeTx { |
| 20 | + let mut tx = StakeTx { |
| 21 | + from: sk.address(), |
| 22 | + amount, |
| 23 | + nonce, |
| 24 | + pub_key: sk.verifying_key().to_bytes(), |
| 25 | + signature: Signature([0u8; 64]), |
| 26 | + }; |
| 27 | + tx.signature = sk.sign(&tx.signable_bytes()); |
| 28 | + tx |
| 29 | +} |
| 30 | + |
| 31 | +fn signed_bridge_deposit(sk: &SecretKey, amount: u64, nonce: u64, fee: u64) -> BridgeDepositTx { |
| 32 | + let mut tx = BridgeDepositTx { |
| 33 | + from: sk.address(), |
| 34 | + recipient: [0x11u8; 20], |
| 35 | + amount, |
| 36 | + destination_chain_id: SUPPORTED_BRIDGE_CHAIN_IDS[0], |
| 37 | + nonce, |
| 38 | + fee, |
| 39 | + pub_key: sk.verifying_key().to_bytes(), |
| 40 | + signature: Signature([0u8; 64]), |
| 41 | + }; |
| 42 | + tx.signature = sk.sign(&tx.signable_bytes()); |
| 43 | + tx |
| 44 | +} |
| 45 | + |
| 46 | +fn signed_bridge_release( |
| 47 | + sk: &SecretKey, |
| 48 | + recipient: ultradag_coin::address::Address, |
| 49 | + amount: u64, |
| 50 | + deposit_nonce: u64, |
| 51 | + nonce: u64, |
| 52 | +) -> BridgeReleaseTx { |
| 53 | + let mut tx = BridgeReleaseTx { |
| 54 | + from: sk.address(), |
| 55 | + recipient, |
| 56 | + amount, |
| 57 | + source_chain_id: SUPPORTED_BRIDGE_CHAIN_IDS[0], |
| 58 | + deposit_nonce, |
| 59 | + nonce, |
| 60 | + pub_key: sk.verifying_key().to_bytes(), |
| 61 | + signature: Signature([0u8; 64]), |
| 62 | + }; |
| 63 | + tx.signature = sk.sign(&tx.signable_bytes()); |
| 64 | + tx |
| 65 | +} |
| 66 | + |
| 67 | +/// Regression: GHSA-6gwf-frh8-ppw7. |
| 68 | +/// A sole active validator must NOT be able to release funds from the bridge reserve. |
| 69 | +#[test] |
| 70 | +fn single_validator_cannot_drain_bridge() { |
| 71 | + let mut state = StateEngine::new_with_genesis(); |
| 72 | + |
| 73 | + let attacker = SecretKey::generate(); |
| 74 | + let victim = SecretKey::generate(); |
| 75 | + |
| 76 | + state.faucet_credit(&attacker.address(), MIN_STAKE_SATS).unwrap(); |
| 77 | + state.faucet_credit(&victim.address(), 5 * COIN).unwrap(); |
| 78 | + |
| 79 | + // Attacker becomes sole active validator (n = 1). |
| 80 | + let stake_tx = signed_stake(&attacker, MIN_STAKE_SATS, 0); |
| 81 | + state.apply_stake_tx(&stake_tx).unwrap(); |
| 82 | + state.recalculate_active_set(); |
| 83 | + assert!(state.is_active_validator(&attacker.address())); |
| 84 | + assert_eq!(state.active_validators().len(), 1); |
| 85 | + |
| 86 | + // Legit deposit seeds the bridge reserve. |
| 87 | + let deposit_amount = 3 * COIN; |
| 88 | + let deposit_fee = 10_000; |
| 89 | + let dep = signed_bridge_deposit(&victim, deposit_amount, 0, deposit_fee); |
| 90 | + state.apply_bridge_lock_tx(&dep, None, None).unwrap(); |
| 91 | + assert_eq!(state.bridge_reserve(), deposit_amount); |
| 92 | + |
| 93 | + // Attempted drain: fabricated deposit_nonce, self-recipient. |
| 94 | + let attacker_addr = attacker.address(); |
| 95 | + let reserve_before = state.bridge_reserve(); |
| 96 | + let attacker_before = state.balance(&attacker_addr); |
| 97 | + let rel = signed_bridge_release(&attacker, attacker_addr, deposit_amount, 999_999, 1); |
| 98 | + let result = state.apply_bridge_release_tx(&rel); |
| 99 | + |
| 100 | + // Must be rejected by the MIN_BRIDGE_VALIDATORS gate. |
| 101 | + assert!(result.is_err(), "drain attempt with n=1 must be rejected, got: {:?}", result); |
| 102 | + let err_msg = format!("{:?}", result.err().unwrap()); |
| 103 | + assert!( |
| 104 | + err_msg.contains("active validators"), |
| 105 | + "expected rejection to cite active-validator floor, got: {err_msg}" |
| 106 | + ); |
| 107 | + |
| 108 | + // No state mutation on the reserve or attacker balance. |
| 109 | + assert_eq!(state.bridge_reserve(), reserve_before); |
| 110 | + assert_eq!(state.balance(&attacker_addr), attacker_before); |
| 111 | +} |
| 112 | + |
| 113 | +/// With exactly `MIN_BRIDGE_VALIDATORS - 1` active validators, releases are still blocked. |
| 114 | +#[test] |
| 115 | +fn releases_blocked_just_below_min_bridge_validators() { |
| 116 | + let mut state = StateEngine::new_with_genesis(); |
| 117 | + |
| 118 | + let validators: Vec<SecretKey> = (0..MIN_BRIDGE_VALIDATORS - 1) |
| 119 | + .map(|_| SecretKey::generate()) |
| 120 | + .collect(); |
| 121 | + |
| 122 | + for sk in &validators { |
| 123 | + state.faucet_credit(&sk.address(), MIN_STAKE_SATS).unwrap(); |
| 124 | + let stake_tx = signed_stake(sk, MIN_STAKE_SATS, 0); |
| 125 | + state.apply_stake_tx(&stake_tx).unwrap(); |
| 126 | + } |
| 127 | + state.recalculate_active_set(); |
| 128 | + assert_eq!(state.active_validators().len(), MIN_BRIDGE_VALIDATORS - 1); |
| 129 | + |
| 130 | + // Seed the reserve. |
| 131 | + let donor = SecretKey::generate(); |
| 132 | + state.faucet_credit(&donor.address(), 10 * COIN).unwrap(); |
| 133 | + let dep = signed_bridge_deposit(&donor, 5 * COIN, 0, 10_000); |
| 134 | + state.apply_bridge_lock_tx(&dep, None, None).unwrap(); |
| 135 | + |
| 136 | + let v0 = &validators[0]; |
| 137 | + let rel = signed_bridge_release(v0, v0.address(), 1 * COIN, 42, 1); |
| 138 | + let result = state.apply_bridge_release_tx(&rel); |
| 139 | + assert!(result.is_err(), "release must be blocked below MIN_BRIDGE_VALIDATORS"); |
| 140 | +} |
| 141 | + |
| 142 | +/// Normal path: with a healthy set, a single vote is not enough (MIN_BRIDGE_QUORUM floor) |
| 143 | +/// but quorum is reachable once enough independent validators attest. |
| 144 | +#[test] |
| 145 | +fn healthy_set_requires_min_quorum_votes() { |
| 146 | + let mut state = StateEngine::new_with_genesis(); |
| 147 | + |
| 148 | + // Use MIN_BRIDGE_VALIDATORS validators — small enough that ceil(2n/3) <= MIN_BRIDGE_QUORUM, |
| 149 | + // so the MIN_BRIDGE_QUORUM floor is the effective threshold. |
| 150 | + let n = MIN_BRIDGE_VALIDATORS; |
| 151 | + let validators: Vec<SecretKey> = (0..n).map(|_| SecretKey::generate()).collect(); |
| 152 | + for sk in &validators { |
| 153 | + state.faucet_credit(&sk.address(), MIN_STAKE_SATS).unwrap(); |
| 154 | + let stake_tx = signed_stake(sk, MIN_STAKE_SATS, 0); |
| 155 | + state.apply_stake_tx(&stake_tx).unwrap(); |
| 156 | + } |
| 157 | + state.recalculate_active_set(); |
| 158 | + assert_eq!(state.active_validators().len(), n); |
| 159 | + |
| 160 | + // Seed the reserve. |
| 161 | + let donor = SecretKey::generate(); |
| 162 | + state.faucet_credit(&donor.address(), 10 * COIN).unwrap(); |
| 163 | + let dep = signed_bridge_deposit(&donor, 5 * COIN, 0, 10_000); |
| 164 | + state.apply_bridge_lock_tx(&dep, None, None).unwrap(); |
| 165 | + |
| 166 | + let recipient = SecretKey::generate().address(); |
| 167 | + let release_amount = 1 * COIN; |
| 168 | + let deposit_nonce = 777; |
| 169 | + |
| 170 | + // First (MIN_BRIDGE_QUORUM - 1) validators vote: release must NOT execute yet. |
| 171 | + // Each validator's account nonce is 1 after their StakeTx, so bridge vote uses nonce 1. |
| 172 | + let reserve_before = state.bridge_reserve(); |
| 173 | + for sk in validators.iter().take(MIN_BRIDGE_QUORUM - 1) { |
| 174 | + let rel = signed_bridge_release(sk, recipient, release_amount, deposit_nonce, 1); |
| 175 | + state.apply_bridge_release_tx(&rel).unwrap(); |
| 176 | + } |
| 177 | + assert_eq!( |
| 178 | + state.bridge_reserve(), |
| 179 | + reserve_before, |
| 180 | + "reserve must be untouched before MIN_BRIDGE_QUORUM votes" |
| 181 | + ); |
| 182 | + |
| 183 | + // The MIN_BRIDGE_QUORUM-th vote crosses the floor: release executes. |
| 184 | + let crossing_voter = &validators[MIN_BRIDGE_QUORUM - 1]; |
| 185 | + let rel_cross = signed_bridge_release(crossing_voter, recipient, release_amount, deposit_nonce, 1); |
| 186 | + state.apply_bridge_release_tx(&rel_cross).unwrap(); |
| 187 | + |
| 188 | + assert_eq!( |
| 189 | + state.bridge_reserve(), |
| 190 | + reserve_before - release_amount, |
| 191 | + "reserve must decrement once MIN_BRIDGE_QUORUM is reached" |
| 192 | + ); |
| 193 | + assert_eq!(state.balance(&recipient), release_amount); |
| 194 | +} |
0 commit comments