Reject a proposal whose proof-of-lock round is malformed

fcecin · fcecin · commit f3092352f17f · 2026-07-20T06:49:22.000-03:00
A Prop's round r and proof-of-lock round vr are decoded from the wire and were
passed to the engine unchecked. A Byzantine proposer for round r could sign a
Prop with vr &gt;= r, violating the consensus state machine's prevote-previous
precondition (it asserts vr &lt; proposal round) and aborting the process. Drop a
Prop unless r is a real round and vr is nil or below r.

Found by auditing every malachite assert reachable from the API this node
drives; this and the behind-vote-Invalid crash were the only app-reachable
abort preconditions hyle could violate.
diff --git a/src/services/runtime.cpp b/src/services/runtime.cpp
@@ -467,6 +467,11 @@ void Runtime::on_message(const PubKey& src, MsgType type, wire::View payload) {
     } catch (const wire::Error&) {
       return;
     }
+    // Rounds come off the wire. r must be a real round, and the proof-of-lock round vr must be nil
+    // (-1) or strictly below r. A crafted vr >= r would violate the consensus state machine's
+    // prevote-previous precondition (it asserts vr < proposal round) and abort the process. A signed
+    // but malformed Prop from a Byzantine proposer is dropped here, not fed to the engine.
+    if (r.value < 0 || vr.value < -1 || vr.value >= r.value) return;
 
     {
       const malachite::ValidatorSet vs = node_.validators_for(h == 0 ? 1 : h);

Original file line number	Diff line number	Diff line change
`@@ -467,6 +467,11 @@ void Runtime::on_message(const PubKey& src, MsgType type, wire::View payload) {`
`467`	`467`	`} catch (const wire::Error&) {`
`468`	`468`	`return;`
`469`	`469`	`}`
	`470`	`+ // Rounds come off the wire. r must be a real round, and the proof-of-lock round vr must be nil`
	`471`	`+ // (-1) or strictly below r. A crafted vr >= r would violate the consensus state machine's`
	`472`	`+ // prevote-previous precondition (it asserts vr < proposal round) and abort the process. A signed`
	`473`	`+ // but malformed Prop from a Byzantine proposer is dropped here, not fed to the engine.`
	`474`	`+ if (r.value < 0 \|\| vr.value < -1 \|\| vr.value >= r.value) return;`
`470`	`475`
`471`	`476`	`{`
`472`	`477`	`const malachite::ValidatorSet vs = node_.validators_for(h == 0 ? 1 : h);`