certusone
/
wormhole
mirror of https://github.com/certusone/wormhole.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

node/watchers/solana: pythnet safety carve out

This commit is contained in:
Evan Gray 2023-11-09 12:10:07 -05:00 committed by Evan Gray
parent 140e8a08d7
commit 4bfcb89d4c
1 changed files with 11 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
node/pkg/watchers/solana/client.go
View File

@ -822,14 +822,17 @@ func (s *SolanaWatcher) processMessageAccount(logger *zap.Logger, data []byte, a
return return
} }
// SECURITY: ensure these fields are zeroed out. in the legacy solana program they were always zero, and in the 2023 rewrite they are zeroed once the account is finalized // As of 2023-11-09, Pythnet has a bug which is not zeroing out these fields appropriately. This carve out should be removed after a fix is deployed.
if !bytes.Equal(proposal.EmitterAuthority.Bytes(), emptyAddressBytes) || proposal.MessageStatus != 0 || !bytes.Equal(proposal.Gap[:], emptyGapBytes) { if s.chainID != vaa.ChainIDPythNet {
solanaAccountSkips.WithLabelValues(s.networkName, "unfinalized_account").Inc() // SECURITY: ensure these fields are zeroed out. in the legacy solana program they were always zero, and in the 2023 rewrite they are zeroed once the account is finalized
logger.Error( if !bytes.Equal(proposal.EmitterAuthority.Bytes(), emptyAddressBytes) || proposal.MessageStatus != 0 || !bytes.Equal(proposal.Gap[:], emptyGapBytes) {
"account is not finalized", solanaAccountSkips.WithLabelValues(s.networkName, "unfinalized_account").Inc()
zap.Stringer("account", acc), logger.Error(
zap.Binary("data", data)) "account is not finalized",
return zap.Stringer("account", acc),
zap.Binary("data", data))
return
}
} }
var txHash eth_common.Hash var txHash eth_common.Hash