[Backport] 5.2.0 cs backports #2430
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
furszy
approved these changes
Jun 18, 2021
>>> Backports dced6c0 (PIVX-Project#2258) The validation for P2CS scriptPubKey is incomplete and doesn't check all the opcodes. This opens a vulnerability. A script could be crafted so that: * it is identified as P2CS (passing IsPayToColdStaking), and recognized by the wallet as ISMINE_SPENDABLE_DELEGATED. * the assumed owner is not actually the owner (or not the only one) of the coins. In this Proof of concept, we craft a script that is recognized as own P2CS by the owner wallet, but can actually be spent with **any** key. This is achieved by including OP_DROP in a strategic position, so that, during the script evaluation, part of the locking condition (included only to fake IsPayToColdStaking) is removed, and replaced by a new condition embedded in the spending scriptSig.
>>> Backports 889a9e7 (PIVX-Project#2258) Ensure stack consistency (size, signature and pubkey encoding) during evaluation
>>> Backports 74bc415 (PIVX-Project#2258) check the whole script template (leave only the 20 bytes for the staker keyID and 20 for the owner keyID).
>>> adapted from df11631 (PIVX-Project#2275) without introducing the new opcode
>>> Backports caad3fb57fa8d7e4b33405be21dee8fa3659932c (PIVX-Project#2428)
random-zebra
force-pushed
the
202106_5.2-cs-backports
branch
from
3698900 to
62bf095
Compare
Author
|
Rebased on 5.2 to run updated GA jobs. |
furszy
approved these changes
Jun 19, 2021
Fuzzbawls
approved these changes
Jun 19, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backports #2258 and #2428