Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Invalid proofs #15

Merged
merged 4 commits into from
Sep 27, 2018
Merged

Invalid proofs #15

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a5105ef
Mark a few functions as `internal`
lorenzb Aug 24, 2018
314d3fc
Revert on invalid proof
lorenzb Aug 24, 2018
92a2652
turn an `assert` into a `require`
lorenzb Aug 24, 2018
6ae6b50
Add some manual soundness tests
lorenzb Aug 24, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
89 changes: 38 additions & 51 deletions onchain/ProvethVerifier.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ contract ProvethVerifier {
);
}

function decodeNibbles(bytes compact, uint skipNibbles) returns (bytes memory nibbles) {
function decodeNibbles(bytes compact, uint skipNibbles) internal returns (bytes memory nibbles) {
require(compact.length > 0);

uint length = compact.length * 2;
Expand All @@ -82,7 +82,7 @@ contract ProvethVerifier {
assert(nibblesLength == nibbles.length);
}

function merklePatriciaCompactDecode(bytes compact) returns (bytes memory nibbles) {
function merklePatriciaCompactDecode(bytes compact) internal returns (bytes memory nibbles) {
require(compact.length > 0);
uint first_nibble = uint8(compact[0]) >> 4 & 0xF;
uint skipNibbles;
Expand All @@ -96,16 +96,12 @@ contract ProvethVerifier {
skipNibbles = 1;
} else {
// Not supposed to happen!
require(false);
revert();
}
return decodeNibbles(compact, skipNibbles);
}

function exposeMerklePatriciaCompactDecode(bytes compact) returns (bytes nibbles) {
return merklePatriciaCompactDecode(compact);
}

function isPrefix(bytes prefix, bytes full) returns (bool) {
function isPrefix(bytes prefix, bytes full) internal returns (bool) {
if (prefix.length > full.length) {
return false;
}
Expand All @@ -119,7 +115,7 @@ contract ProvethVerifier {
return true;
}

function sharedPrefixLength(uint xsOffset, bytes xs, bytes ys) returns (uint) {
function sharedPrefixLength(uint xsOffset, bytes xs, bytes ys) internal returns (uint) {
for (uint i = 0; i + xsOffset < xs.length && i < ys.length; i++) {
if (xs[i + xsOffset] != ys[i]) {
return i;
Expand Down Expand Up @@ -153,9 +149,9 @@ contract ProvethVerifier {
);
}

uint8 constant public TX_PROOF_RESULT_INVALID = 0;
uint8 constant public TX_PROOF_RESULT_PRESENT = 1;
uint8 constant public TX_PROOF_RESULT_ABSENT = 2;

function txProof(
bytes32 blockHash,
bytes proofBlob
Expand Down Expand Up @@ -190,26 +186,19 @@ contract ProvethVerifier {
bytes32 blockHash,
bytes proofBlob
) internal returns (uint8 result, uint256 index, Transaction memory t) {
result = TX_PROOF_RESULT_INVALID;
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure why you're getting rid of this? I generally favor descriptive names to returning an integer, but it's probably fine either way

Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I got rid of TX_PROOF_RESULT_INVALID, since we now revert on invalid proofs.
But I could probably kick out

result = 0;
index = 0;

since that's the default anyways.

result = 0;
index = 0;
Proof memory proof = decodeProofBlob(proofBlob);
require(proof.stack.length == proof.stackIndexes.length);
if (proof.kind != 1) {
return;
revert();
}

if (keccak256(proof.rlpBlockHeader) != blockHash) {
return;
revert();
}

// TODO(lorenzb): Validate structure of indexes, e.g. last index == 2 if we have a Leaf, etc...

bool valid;
bytes memory rlpTx;
(valid, rlpTx) = validateMPTProof(proof.txRootHash, proof.mptPath, proof.stackIndexes, proof.stack);
if (!valid) {
return;
}
bytes memory rlpTx = validateMPTProof(proof.txRootHash, proof.mptPath, proof.stackIndexes, proof.stack);

bytes memory mptKeyNibbles = decodeNibbles(proof.rlpTxIndex, 0);
if (rlpTx.length == 0) {
Expand All @@ -219,7 +208,7 @@ contract ProvethVerifier {
index = proof.txIndex;
return;
} else {
return;
revert();
}
} else {
// tx
Expand All @@ -229,7 +218,7 @@ contract ProvethVerifier {
t = decodeTx(rlpTx);
return;
} else {
return;
revert();
}
}
}
Expand All @@ -247,10 +236,9 @@ contract ProvethVerifier {
bytes mptPath,
bytes stackIndexes,
RLP.RLPItem[] memory stack
) internal returns (bool valid, bytes memory value) {
assert(stackIndexes.length == stack.length);
) internal returns (bytes memory value) {
require(stackIndexes.length == stack.length);

valid = false;
uint mptPathOffset = 0;

bytes32 nodeHashHash;
Expand All @@ -261,9 +249,8 @@ contract ProvethVerifier {

if (stack.length == 0) {
// Root hash of empty tx trie
valid = (rootHash == 0x56e81f171bcc55a6ff8345e692c0f86e5b48e01b996cadc001622fb5e363b421);
value = new bytes(0);
return;
require(rootHash == 0x56e81f171bcc55a6ff8345e692c0f86e5b48e01b996cadc001622fb5e363b421);
return new bytes(0);
}

for (uint i = 0; i < stack.length; i++) {
Expand All @@ -273,10 +260,10 @@ contract ProvethVerifier {
// *rlp-encoded* items.
rlpNode = stack[i].toBytes();
if (i == 0 && rootHash != keccak256(rlpNode)) {
return;
revert();
}
if (i != 0 && nodeHashHash != mptHashHash(rlpNode)) {
return;
revert();
}
node = stack[i].toList();

Expand All @@ -292,24 +279,24 @@ contract ProvethVerifier {

if (i < stack.length - 1) {
// divergent node must come last in proof
return;
revert();
}

if (prefixLength == nodePath.length) {
// node isn't divergent
return;
revert();
}

if (mptPathOffset != mptPath.length) {
// didn't consume entire mptPath
return;
revert();
}

return (true, new bytes(0));
return new bytes(0);
} else if (stackIndexes[i] == 1) {
if (prefixLength != nodePath.length) {
// node is divergent
return;
revert();
}

if (i < stack.length - 1) {
Expand All @@ -322,22 +309,22 @@ contract ProvethVerifier {
} else {
// didn't consume entire mptPath
if (mptPathOffset != mptPath.length) {
return;
revert();
}

rlpValue = node[uint(stackIndexes[i])];
return (true, rlpValue.toData());
return rlpValue.toData();
}
} else {
// an extension/leaf node only has two fields.
return;
revert();
}
} else if (node.length == 17) {
// Branch node
if (stackIndexes[i] < 16) {
// advance mptPathOffset
if (mptPathOffset >= mptPath.length || mptPath[mptPathOffset] != stackIndexes[i]) {
return;
revert();
}
mptPathOffset += 1;

Expand All @@ -352,39 +339,39 @@ contract ProvethVerifier {
// last level
// must have an empty hash, everything else is invalid
if (node[uint(stackIndexes[i])].toData().length != 0) {
return;
revert();
}

if (mptPathOffset != mptPath.length) {
// didn't consume entire mptPath
return;
revert();
}

return (true, new bytes(0));
return new bytes(0);
}
} else if (stackIndexes[i] == 16) { // we want the value stored in this node
if (i < stack.length - 1) {
// value must come last in proof
return;
revert();
}

if (mptPathOffset != mptPath.length) {
// didn't consume entire mptPath
return;
revert();
}

rlpValue = node[uint(stackIndexes[i])];
return (true, rlpValue.toData());
return rlpValue.toData();
} else {
throw;
revert();
}
} else {
throw; // This should never happen as we have
// already authenticated node at this point.
revert(); // This should never happen as we have
// already authenticated node at this point.
}
}

// We should never reach this point.
throw;
revert();
}
}
}
85 changes: 82 additions & 3 deletions onchain/test/test_ProvethVerifier.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
import collections
import copy
import json
import os
import sys
Expand Down Expand Up @@ -123,18 +124,95 @@ def test_merklePatriciaCompactDecode(self):
utils.decode_hex('0f010c0b08'),
self.verifier_contract.exposedMerklePatriciaCompactDecode(utils.decode_hex('3f1cb8')))


def test_manual1(self):
# from block 1322230 on ropsten
proof_blob = utils.decode_hex('f903be01f90217a05b5782c32df715c083da95b805959d4718ec698915a4b0288e325aa346436be1a01dcc4de8dec75d7aab85b567b6ccd41ad312451b948a7413f0a142fd40d4934794fee3a49dc4243fa92019fc4331228043b3c5e825a013a50145091c1b5bae07abe10da88c54c5111c3fbb74fc91074ad2ffec311f6ba00c673fc4822ba97cc737cfa7a839d6f6f755deedb1506490911f710bfa9315bfa00c1fcb2441331ab1abc2e174a7293acce160d0b04f35a4b791bf89e9fd452b10b9010000000000000000200000000000000000000000000010002000000000000000000040000000000000000000000010000000000000000000000040000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000100840c0b580c83142cf68347e7c4830428a184596e599f99d883010606846765746887676f312e382e338664617277696ea06ebda3617b113ba6550d08cb34119f940ddb96b509c62b7d0a8420722329d5b48861ebb9e58c93ac260182000183000101f90198f851a0da42945ae3c75118e89abff39ad566fd0a30b574e5df8ae70ce59d4cc5f19cb180808080808080a0ca85a0d0ed219e8583feadf2dce0a73aa05e7d6a790c32efcc1dd6c901195f168080808080808080f8b180a0e61bb422a77353192ae2b4b29c3773b018da71d1425b2a48cca04d7da9917faba06b46aad90e0a9eeede8f2ad992401e52b3e52ce7d5bf723a48922401d5af95cca0997f63912b72cdf8a907025644e1df51c313015c4e9e51500fa6ffa52241eef4a05ad4d0c46a043da4e1da601955a1d29d5bd3b6c5b2dfc2776c8a898f998af498a0457048648440cf69193e770035a2df6f42ab5a6b8bc4d789a92074dc2beb20918080808080808080808080f89020b88df88b820beb8506fc23ac00832dd5d8943d04303126cd6e75324825455685b028401e0ec280a4e733ca974e6964610000000000000000000000000000000000000000000000000000000029a0f5405ffd54b78fc27dc56c49364ec22ba94c471f4639f052cfe324e3fc05d1d3a041291d64a8cdf499c386fde5bc04a1ca743aa81f65dc59198d29f8d66ee588a5')
decoded_proof_blob = [
'01',
[
'5b5782c32df715c083da95b805959d4718ec698915a4b0288e325aa346436be1',
'1dcc4de8dec75d7aab85b567b6ccd41ad312451b948a7413f0a142fd40d49347',
'fee3a49dc4243fa92019fc4331228043b3c5e825',
'13a50145091c1b5bae07abe10da88c54c5111c3fbb74fc91074ad2ffec311f6b',
'0c673fc4822ba97cc737cfa7a839d6f6f755deedb1506490911f710bfa9315bf',
'0c1fcb2441331ab1abc2e174a7293acce160d0b04f35a4b791bf89e9fd452b10',
'00000000000000200000000000000000000000000010002000000000000000000040000000000000000000000010000000000000000000000040000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000100',
'0c0b580c',
'142cf6',
'47e7c4',
'0428a1',
'596e599f',
'd883010606846765746887676f312e382e338664617277696e',
'6ebda3617b113ba6550d08cb34119f940ddb96b509c62b7d0a8420722329d5b4',
'61ebb9e58c93ac26',
],
'01',
'0001',
'000101',
[
['da42945ae3c75118e89abff39ad566fd0a30b574e5df8ae70ce59d4cc5f19cb1', '', '', '', '', '', '', '', 'ca85a0d0ed219e8583feadf2dce0a73aa05e7d6a790c32efcc1dd6c901195f16', '', '', '', '', '', '', '', ''],
['', 'e61bb422a77353192ae2b4b29c3773b018da71d1425b2a48cca04d7da9917fab', '6b46aad90e0a9eeede8f2ad992401e52b3e52ce7d5bf723a48922401d5af95cc', '997f63912b72cdf8a907025644e1df51c313015c4e9e51500fa6ffa52241eef4', '5ad4d0c46a043da4e1da601955a1d29d5bd3b6c5b2dfc2776c8a898f998af498', '457048648440cf69193e770035a2df6f42ab5a6b8bc4d789a92074dc2beb2091', '', '', '', '', '', '', '', '', '', '', ''],
['20', 'f88b820beb8506fc23ac00832dd5d8943d04303126cd6e75324825455685b028401e0ec280a4e733ca974e6964610000000000000000000000000000000000000000000000000000000029a0f5405ffd54b78fc27dc56c49364ec22ba94c471f4639f052cfe324e3fc05d1d3a041291d64a8cdf499c386fde5bc04a1ca743aa81f65dc59198d29f8d66ee588a5'],
],
]
block_hash = utils.decode_hex('51c92d45e39db17e43f0f7333de44c592b504bb8ac24dc3c39135d46655bae4f')
result, index, nonce, gas_price, gas, to, value, data, v, r, s = self.verifier_contract.txProof(
block_hash,
proof_blob,
rlp.encode(rec_bin(decoded_proof_blob)),
startgas=10**6)
self.assertEqual(result, self.verifier_contract.TX_PROOF_RESULT_PRESENT())
self.assertEqual(index, 1)

def assert_failed_call(modified_decoded_proof_blob, block_hash=block_hash):
with self.assertRaises(t.TransactionFailed):
_ = self.verifier_contract.txProof(
block_hash,
rlp.encode(rec_bin(modified_decoded_proof_blob)),
startgas=10**6)

assert_failed_call(decoded_proof_blob, block_hash=utils.decode_hex('51c92d45e39db17e43f0f7333de44c592b504bb8ac24dc3c39135d46655bae40'))

modified_decoded_proof_blob = copy.deepcopy(decoded_proof_blob)
modified_decoded_proof_blob[0] = 'ab'
assert_failed_call(modified_decoded_proof_blob)

modified_decoded_proof_blob = copy.deepcopy(decoded_proof_blob)
modified_decoded_proof_blob[1][0] = '5b5782c32df715c083da95b805959d4718ec698915a4b0288e325aa346436be2'
assert_failed_call(modified_decoded_proof_blob)

modified_decoded_proof_blob = copy.deepcopy(decoded_proof_blob)
modified_decoded_proof_blob[2] = '02'
assert_failed_call(modified_decoded_proof_blob)

modified_decoded_proof_blob = copy.deepcopy(decoded_proof_blob)
modified_decoded_proof_blob[3] = '0101'
assert_failed_call(modified_decoded_proof_blob)

modified_decoded_proof_blob = copy.deepcopy(decoded_proof_blob)
modified_decoded_proof_blob[3] = '000100'
assert_failed_call(modified_decoded_proof_blob)

modified_decoded_proof_blob = copy.deepcopy(decoded_proof_blob)
modified_decoded_proof_blob[4] = '0001ff'
assert_failed_call(modified_decoded_proof_blob)

modified_decoded_proof_blob = copy.deepcopy(decoded_proof_blob)
modified_decoded_proof_blob[5][0][0] = 'da42945ae3c75118e89abff39ad566fd0a30b574e5df8ae70ce59d4cc5f19cb2'
assert_failed_call(modified_decoded_proof_blob)

modified_decoded_proof_blob = copy.deepcopy(decoded_proof_blob)
modified_decoded_proof_blob[5][1][1] = 'e61bb422a77353192ae2b4b29c3773b018da71d1425b2a48cca04d7da9917fac'
assert_failed_call(modified_decoded_proof_blob)

modified_decoded_proof_blob = copy.deepcopy(decoded_proof_blob)
modified_decoded_proof_blob[5][2][0] = '21'
assert_failed_call(modified_decoded_proof_blob)

modified_decoded_proof_blob = copy.deepcopy(decoded_proof_blob)
modified_decoded_proof_blob[5][2][1] = modified_decoded_proof_blob[5][2][1].replace(
'e733ca974e69646100000000000000000000000000000000000000000000000000000000',
'f733ca974e69646100000000000000000000000000000000000000000000000000000000')
assert_failed_call(modified_decoded_proof_blob)


def test_manual2(self):
proof_blob = utils.decode_hex('f904c601f90203a0e7c29816452c474e261b1d02d3bab489df00069892863bc654ddd609b7f7fc4ba01dcc4de8dec75d7aab85b567b6ccd41ad312451b948a7413f0a142fd40d4934794b2930b35844a230f00e51431acae96fe543a0347a00272d32e39cf493242e079965942776e1a6492e74532eb25d5ed8f56aab40331a01b0134ed566a1bf54f29bd55929b75139de4450d8bf43d33b02a1b26b4873af6a0b9b5d8d9f58ad6b835be1b1bde2461e809905257c2610329fe94de5109c2cfadb9010003424803034030147969000005008084532a1c8a0020000400000424302c0578310012204d0883204010ca0000401800020448800000909104008110e02b006000060142000000994112c20924a0200002820020002402000801001020004412203000281600200000c1802940080a1c0010a029080410408a0020150400681c32020104600800004400100900032840000285000800209440420209010500800606200010420003050010100064884080000c23a02080c130028054a401080040086402088c0252005c00000000e82000406005824800412011200c2020a0010810000901120010020c08c4a000828440040008a004608950810200c208008887090e046147907c834c4d6b837a11d38379ca58845a709667827331a0915aa3cd5dea74d24e39ffd6acc5da3b2b692d4b3fcc6cc26222b9205fd64b46880eb2c4f807cb142481828408010802850801010201f902aff90131a08e61195faa58f0c8467b7f62a15ec6122d7f9484021eaf7b9fe372fffde310b8a05b9674e1d977f6a30fc12a9ac35aeecbbe0d49dcc0d8952e5d833539504ca649a05262513c779d4d62f559300126b4a34435923dceadd291ec3e1d4da6d284b8fca0672d7beb02403cbf570f2aa2956d3d6a8be5b928a425ee263e744db509958d06a0cb1005949f6f4f14beeaf39c9ee07fc2cf68fcb804aaecc4168828bb265f3f1ca0d89a971d2813936524ef4e38ee2dd300cf02764bec57845b8c0064118246ab97a014d80d349c773c690ef2711a7c4c916cec6a333594d378d2b6cebf2bff1c9ce2a0a932d14ab39608d22c0ba8a0e2fafa8a9359968f29b34827cff06e3cc5d0fdeea059d69a507142ffd21a40f829f094f283758e8a32b077c8373a6215cc0e0d61328080808080808080f851a0af2178a9930004f22ee1e2eb87f1035e559971de937dc9ae6f6ba7b6640df2a7a0d92a714520fe45d10652c6b429ca037104644bae3fe13edb8e52b2efb645e16a808080808080808080808080808080e218a01bf683031aaa6ef9c75509021a8ba5f4c9eb6f134413d57b2d3ae92699f58d95f891a06b621312dca8604610878ecf0384c9855dd6e388a0d587441be1dedfe2c73804a0530e3712b1763a989ef0b80b5a90619e7b0452069f1cf4ba3be0a7459a8654cca05f174cd7f8bd7be186b9f8127e181be52bb94cc662f36a8ec1fa3c6083db0ec7a0d94d6ab7f87669a948645e2191b193672be0720018f15115e71720140a027f3e80808080808080808080808080f87020b86df86b821935843b9aca00825208944ce3adf23418a3c3f4a61cde1c7057677befd9bf86719a2d5d6e008025a0121772bdbd0945dcfea42152186b9f7ae6d0271fdd6d1777fcadf5383a88336ca021196e93025480173f429c9e9a27c1921dd6c10b3705c30125424285250bd5a5')
Expand All @@ -146,6 +224,7 @@ def test_manual2(self):
self.assertEqual(result, self.verifier_contract.TX_PROOF_RESULT_PRESENT())
self.assertEqual(index, 130)


def help_test_entire_block(self, path_to_jsonrpc_response):
PRESENT = self.verifier_contract.TX_PROOF_RESULT_PRESENT()
ABSENT = self.verifier_contract.TX_PROOF_RESULT_ABSENT()
Expand Down