New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security: Provider fees check #307

Closed

alexcos20 opened this issue Mar 4, 2024 · 0 comments

Assignees

Labels

Milestone

Member

alexcos20 commented Mar 4, 2024

We do provider fees checks, but we don't validate that providerAddress is actually our address (ie: we signed those provider fees)

Attack vector:

I will deploy my own node
Prepare providerFees for an asset with 0 fees (free)
pass that providerFee structure in an order
use that order with the attack node download endpoint -> I get to download for free, because providerFee structure is valid

alexcos20 added Type: Bug Priority: Critical labels

alexcos20 self-assigned this

alexcos20 added a commit that referenced this issue


          fix #307

16a7be9

alexcos20 added this to the alfa release milestone

alexcos20 added Type: Question and removed Type: Bug Priority: Critical labels

giancu4 closed this as completed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment