https://hackerone.com/reports/2279584

Summary:

The Primary recursively fetch certificates from other peer upon receiving new Propose and BatchCertificate . Although it will check the certificate before storing into db, the check is at end of the recursion.

A malicious validator can create fake certificate that contains other fake certificate at the same round. Then the recursion will never ends and lead to stack overflow. The call stack will be like this:

sync_with_certificate_from_peer
    sync_with_batch_header_from_peer
        sync_with_certificate_from_peer
             ....

The attacker can crash all other validator in this way.

Steps To Reproduce:

See the commit: Gooong@3e7c686

1. Clone the repo above
2. Run ./devnet.sh
3. Wait round 5
4. Check the log and we will find some node crashed: fatal runtime error: stack overflow

Proof-of-Concept (PoC)

How this bug can be exploited:

The attacker just broadcast fake certificate. This will cause all other validator continously crash and shutdown the network.

Supporting Material/References:

See the attachment

Impact

Cause validators crash and shutdown the network.

Fix suggestions:

Strictly check certificate before the recursion.