You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We need to enhance the robustness of our system by including more stringent validations. Our current framework does not have a mechanism to authenticate X-Forwarded-For headers or manage an overload of transactions that surpass our zkCounter limitations.
Recommended Changes:
Verify IP in the Transaction Pool:
Introduce a function within the tryToAddTxToPool method to authenticate IP addresses retrieved from the X-Forwarded-For header.
Verify IP in the Worker:
Confirm IP addresses in the Worker.AddTxTracker prior to appending them to the efficiency list. This acts as a secondary check against invalid or suspicious IP addresses.
Refinement of ZKCounters and Shared Configuration:
Restructure the BatchConstraints and BatchResourceWeights config parameters into a mutual BatchConfig structure. This structure will be employed by the JSON-RPC to confirm that the resources consumed by a transaction do not exceed the prescribed limits. If a transaction surpasses these limitations, it will be bypassed and not included in the transaction pool. In the same vein, the Sequencer will skip such transactions and not add them to the Worker's efficiencyList.
Objective:
Implementing these changes will contribute to the fortification of our services by safeguarding against potential system overloads and ensuring steady operations. These steps will help prevent undue resource consumption and ensure the maintenance of data consistency.
The text was updated successfully, but these errors were encountered:
Psykepro
changed the title
Fixing security Issues reported in ASF-315
Enhance System Robustness with Improved Validations and Configuration Management
Aug 14, 2023
Overview:
We need to enhance the robustness of our system by including more stringent validations. Our current framework does not have a mechanism to authenticate
X-Forwarded-For
headers or manage an overload of transactions that surpass ourzkCounter
limitations.Recommended Changes:
Verify IP in the Transaction Pool:
tryToAddTxToPool
method to authenticate IP addresses retrieved from theX-Forwarded-For
header.Verify IP in the Worker:
Worker.AddTxTracker
prior to appending them to the efficiency list. This acts as a secondary check against invalid or suspicious IP addresses.Refinement of ZKCounters and Shared Configuration:
BatchConstraints
andBatchResourceWeights
config parameters into a mutualBatchConfig
structure. This structure will be employed by theJSON-RPC
to confirm that the resources consumed by a transaction do not exceed the prescribed limits. If a transaction surpasses these limitations, it will be bypassed and not included in the transactionpool
. In the same vein, theSequencer
will skip such transactions and not add them to theWorker
'sefficiencyList
.Objective:
Implementing these changes will contribute to the fortification of our services by safeguarding against potential system overloads and ensuring steady operations. These steps will help prevent undue resource consumption and ensure the maintenance of data consistency.
The text was updated successfully, but these errors were encountered: