-
Notifications
You must be signed in to change notification settings - Fork 144
fix(l1): validate pivot block body during snap sync #5451
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull request overview
This PR fixes a security vulnerability where block body validation was skipped during snap sync. The fix consolidates two similar methods into one that always validates block bodies against their headers by checking that transactions and withdrawals match the roots in the header.
- Renamed
request_and_validate_block_bodiestorequest_block_bodiesand removed the old non-validating version - Updated
store_block_bodiesto accept block headers instead of block hashes to enable validation - Modified snap sync code path to pass the pivot block header for validation
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| crates/networking/p2p/peer_handler.rs | Removed the old non-validating request_block_bodies method and renamed request_and_validate_block_bodies to request_block_bodies to ensure all block body requests are validated |
| crates/networking/p2p/sync.rs | Updated store_block_bodies to accept block headers instead of hashes, enabling validation; updated the snap sync code path to pass the pivot header for validation |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.
Lines of code reportTotal lines added: Detailed view |
Motivation
We weren't checking the transactions and withdrawals match with the roots in the header during snap sync body downloads. This was due to one of the body download methods being without validation, which leads to confusion.
Description
This PR changes the method that's used during snap-sync to
request_and_validate_block_bodies. It also removes the oldrequest_block_bodies, renamingrequest_and_validate_block_bodies.