Skip to content
This repository has been archived by the owner on Jun 11, 2024. It is now read-only.

Lack of ChannelData schema validation in InitializeMessageRecoveryCommand #8621

Closed
Tracked by #7226
ishantiw opened this issue Jun 16, 2023 · 0 comments
Closed
Tracked by #7226
Assignees
Milestone

Comments

@ishantiw
Copy link
Contributor

Description

The ChannelData provided by the user in the InitializeMessageRecoveryCommand command is decoded but not validated. The inclusion proof prevents rogue values from being used (although a malicious chain could create invalid accounts). We also note that passing the empty string value to trigger a non-inclusion proof is possible, but the decoding would fail in the execute method.

Which version(s) does this affect? (Environment, OS, etc...)

v6.0.0-beta.2

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

3 participants