[Bug] Due to changes from PR #3217, BFT sync logic is not safe, 2 malicious validators can send invalid block_locators and blocks to other nodes and halt the network about snarkos HOT 4 OPEN

@ghostant-1017 Happy to re-evaluate the report security, lets correspond in HackerOne regarding that.

In the meantime, we have another addition to this fix in the form of https://github.com/AleoHQ/snarkOS/pull/3233 that addresses an edge case. Would love you have your review of this as well.

from snarkos.

This PR should address the issue - https://github.com/AleoHQ/snarkOS/pull/3232.

The finding was related to another issue we were observing in devnet, but this change should address both concerns.

@ghostant-1017 Please confirm if you believe this fix is sufficient!

from snarkos.

Hi @raychu86 ,
The attack doesn't work only for validators which is syncing. In fact, it works for ALL SYNCED validators.
The attacker will always generate block which height is latest_height + 1, so that other validators will find themselves are behind, and send BlockRequest to the attacker.
Please reevaluate the severity of the report. Thank you!

from snarkos.