Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Factory UTxO should not contain other assets except ADA and Factory NFT #54

Closed
h2physics opened this issue Jun 2, 2024 · 0 comments · Fixed by #56
Closed

Factory UTxO should not contain other assets except ADA and Factory NFT #54

h2physics opened this issue Jun 2, 2024 · 0 comments · Fixed by #56
Assignees
Labels
bug Something isn't working Medium any which don’t pose financial risk to users

Comments

@h2physics
Copy link
Member

Suggested by @micahkendall

I believe factory may be vulnerable to a DOS attack on the value field. Depending on costing parameters, this could either make it more expensive to insert factories or it could make it greater than the budget which would break insertions

I'm going to double check and write a description

Here is the attack:

  • offchain, define an "attacking policy" as a native script with a random salt, that happens to put the policy id as being lesser than the authen policy id
  • generate as many of these policies as necessary, with the asset name being empty and the quantity being 1
  • insert these assets into the value along with the factory NFT, when a new DEX is made.
  • because the quantity_of has to be a linear search left to right over the list, this operation has to skip over every policy that has been inserted, consuming exunits
  • depending on how much this costs, this could cause the budget to be exceeded, which would freeze the ability of minswap to insert more dexes
  • to validate this attack, we would have to consider the memory usage of the quantity_of operation for large numbers of policies, and whether the necessary count of policies can actually fit in a transaction which constructs a valid factory
  • to resolve this attack, simply limit the number of values in the factory value to the maximum necessary
  • Also, on a technicality, you have to mint all the attacking assets in a transaction before the attack, because the tx prevents minting other assets, but it's still viable because you can just spend the assets from a user input from a previous tx
@h2physics h2physics added the bug Something isn't working label Jun 2, 2024
@h2physics h2physics self-assigned this Jun 2, 2024
@h2physics h2physics added the Medium any which don’t pose financial risk to users label Jun 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working Medium any which don’t pose financial risk to users
Projects
None yet
1 participant