Skip to content

fix potential median consensus attack vector #339

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ettec merged 2 commits into from
Oct 29, 2025
Merged

fix potential median consensus attack vector #339

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ec15ddf
fix potential median consensus attack vector
ettec Oct 29, 2025
840ef19
check sufficient values after corrupt value exclusion
ettec Oct 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 17 additions & 9 deletions consensus/oracle/consensus_execution.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,7 +144,7 @@ func handleFieldsMapAggregation(
}

func handleMedianAggregation(
_ logger.Logger,
lggr logger.Logger,
observations []*valuespb.Value,
f int,
) (*valuespb.Value, error) {
Expand All @@ -163,7 +163,7 @@ func handleMedianAggregation(

switch medianType {
case typeUint64:
medianResult, err = getMedian(
medianResult, err = getMedian(lggr,
filtered,
func(val *valuespb.Value) (uint64, error) {
return val.GetUint64Value(), nil
Expand All @@ -184,7 +184,7 @@ func handleMedianAggregation(
}

case typeInt64:
medianResult, err = getMedian(
medianResult, err = getMedian(lggr,
filtered,
func(val *valuespb.Value) (int64, error) {
return val.GetInt64Value(), nil
Expand All @@ -205,7 +205,7 @@ func handleMedianAggregation(
}

case typeFloat64:
medianResult, err = getMedian(
medianResult, err = getMedian(lggr,
filtered,
func(val *valuespb.Value) (float64, error) {
return val.GetFloat64Value(), nil
Expand All @@ -226,7 +226,7 @@ func handleMedianAggregation(
}

case typeDecimal:
medianResult, err = getMedian(
medianResult, err = getMedian(lggr,
filtered,
func(val *valuespb.Value) (decimal.Decimal, error) {
var d decimal.Decimal
Expand All @@ -246,7 +246,7 @@ func handleMedianAggregation(
}

case typeBigInt:
medianResult, err = getMedian(
medianResult, err = getMedian(lggr,
filtered,
func(val *valuespb.Value) (*big.Int, error) {
var got big.Int
Expand All @@ -266,7 +266,7 @@ func handleMedianAggregation(
}

case typeTime:
medianResult, err = getMedian(
medianResult, err = getMedian(lggr,
filtered,
func(val *valuespb.Value) (time.Time, error) {
var got time.Time
Expand Down Expand Up @@ -496,6 +496,7 @@ func filterObservations(observationProtos []*valuespb.Value, minObservations int
//
// For an even number of elements, we take the left of the two middle elements.
func getMedian[T any](
lggr logger.Logger,
observations []*valuespb.Value,
unwrap func(val *valuespb.Value) (T, error),
compare func(a, b T) int,
Expand All @@ -509,9 +510,16 @@ func getMedian[T any](
for _, v := range observations {
unwrapped, err := unwrap(v)
if err != nil {
return nil, err
// It's possible the value could be corrupt and fail to unwrap, so skip and log warning as this should not happen
lggr.Warnf("failed to unwrap observation during median calculation: %s", err)
} else {
unwrappedValues = append(unwrappedValues, unwrapped)
}
unwrappedValues = append(unwrappedValues, unwrapped)
}

// As values are filtered for unwrapping errors, need to re-check the number of observations is still sufficient for consensus
if len(unwrappedValues) < f+1 {
return nil, ErrInsufficientObservations
}

slices.SortFunc(unwrappedValues, compare)
Expand Down
Loading