SmartContract: restrict the number of allowed notifications #3548

AnnaShaleva · 2024-10-23T16:10:17Z

Description

The problem is described in nspcc-dev/neo-go#3490. In short words, an arbitrary number of smart contract notifications is allowed (up to VM's GasLimit and MaxBlockSystemFee, but it's huge), which results in a possibility to DoS the node. 10K of large notifications emitted in a single transaction result in block acceptance delays for both Go and C# nodes. 50K of large notifications may result in the node failure. I did these tests on privnet, you may find the results in nspcc-dev/neo-go#3490 (comment). Please, don't try to DoS mainnet/testnet using this vulnerability.

Port the solution from nspcc-dev/neo-go#3640, but an alternative solution is described in nspcc-dev/neo-go#3640 (comment) and in nspcc-dev/neo-go#3490 (comment). MaxNotificationsCount constraint is chosen based on the Mainnet statistics of the number of notifications per every transaction, ref. nspcc-dev/neo-go#3490 (comment).

This PR is a subject of discussion, hence please, share your thoughts on the described problem and proposed solution. Once we agree on the solution, I'll add unit-tests to this PR.

Type of change

Breaking change (fix or feature that would cause existing functionality to not work as expected)

How Has This Been Tested?

Unit-tests should be added once we agree on solution.

Checklist:

My code follows the style guidelines of this project
I have performed a self-review of my code
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
My changes generate no new warnings
I have added tests that prove my fix is effective or that my feature works
New and existing unit tests pass locally with my changes
Any dependent changes have been merged and published in downstream modules

Fix the problem described in nspcc-dev/neo-go#3490. Port the solution from nspcc-dev/neo-go#3640. MaxNotificationsCount constraint is chosen based on the Mainnet statistics of the number of notifications per every transaction, ref. nspcc-dev/neo-go#3490 (comment). Signed-off-by: Anna Shaleva <[email protected]>

Signed-off-by: Anna Shaleva <[email protected]>

cschuchardt88 · 2024-10-23T16:20:24Z

This needs to be in VM limit class.

vncoelho · 2024-10-23T16:21:53Z

src/Neo/SmartContract/Native/RoleManagement.cs

@@ -78,7 +78,7 @@ private void DesignateAsRole(ApplicationEngine engine, Role role, ECPoint[] node
            list.AddRange(nodes);
            list.Sort();
            engine.SnapshotCache.Add(key, new StorageItem(list));
-


Formatting job is failing without this change.

AnnaShaleva · 2024-10-23T16:22:11Z

This needs to be in VM limit class.

Strictly speaking, it's not a VM limit. Notifications are not a part of VM, they are a part of execution engine.

vncoelho · 2024-10-23T16:22:57Z

src/Neo/SmartContract/ApplicationEngine.Runtime.cs

+            // Restrict the number of notifications for Application executions. Do not check
+            // persisting triggers to avoid native persist failure. Do not check verification
+            // trigger since verification context is loaded with ReadOnly flag.
+            if (IsHardforkEnabled(Hardfork.HF_Echidna) && Trigger == TriggerType.Application && notifications.Count == MaxNotificationCount)


Looks good to me, we just need to ensure .Count is correct calculated at this step.

Is trigger really needed? Limits shouldn't have a trigger.

Yes, it's needed, because we can't allow OnPersist and PostPersist failures (imagine that in future MaxNotificationCount may be reduced to some lower value). And for Verification trigger this check is useless by design, no notifications are possible with this trigger.

Ref. nspcc-dev/neo-go#3490 (comment).

cschuchardt88 · 2024-10-23T17:12:27Z

This needs to be in VM limit class.

Strictly speaking, it's not a VM limit. Notifications are not a part of VM, they are a part of execution engine.

All the same thing. Class is called ExecutionEngineLimits in Neo.VM namespace. How to use engine.Limit.MaxNotification

src/Neo/SmartContract/ApplicationEngine.Runtime.cs

Jim8y · 2024-10-24T09:31:27Z

instead of limiting number of notifactions, i prefer to make the price related to the notifaction size. From @AnnaShaleva 's excellent benchmark, i think size * number is the real reason. Cause i think its a normal practice contract may need to send a lof of notifactions, but definately abnormal to send large notifactions.

AnnaShaleva · 2024-10-24T11:00:30Z

i think size * number is the real reason

Exactly, as described in nspcc-dev/neo-go#3490 (comment).

i prefer to make the price related to the notifaction size.

Yes, it's an alternative solution proposed in nspcc-dev/neo-go#3490 (comment). But we need to discuss it because even with extremely expensive notifications there's a chance that CNs will be killed by a single transaction. Yes, the user will have to pay for it, but CNs may not be able to process this transaction. Also, large number of notifications is harmful for both C# and Go RPC servers.

So to me, the restriction of the overall notifications number is required, but at the same time it can be combined with dynamic price solution.

shargon

Agree with @Jim8y pay extra per notification size

roman-khimov · 2024-10-24T16:28:09Z

Economics.

Currently System.Runtime.Notify is priced at 32768×ExecutionFeeFactor, for mainnet that's roughly 98K datoshis.

Storage fee price is 10K datoshis per byte for mainnet.

Typical NEP-17 Transfer is ~50 bytes. So storing it on-chain is 500K datoshis. Emitting as an event is 98K. Seems to be fair enough, roughly 2K per byte or five times cheaper. If we're to extend this multiplier to 1024-byte event that'd be 2M datoshis or 0.02048 GAS. Multiply it over 50K events and you get a 1024 GAS cost. Which is 4-5K USD at the moment and is allowed by MaxBlockSystemFee (#3552). So currently this economics doesn't really work to solve the problem.

Based on nspcc-dev/neo-go#3490 even 10K are problematic (204.8 GAS with 2K per byte), so we better target at 2-5K as being practically impossible. Which doesn't really work even with 10K per byte since 10K events would cost the same 1024 GAS then. (side note: @steven1227, these calculations are also relevant for any fee reduction talks)

Not sure we can balance this economically.

shargon · 2024-10-24T17:50:14Z

Which doesn't really work even with 10K per byte since 10K events wo

More than X notifications (100?), can be priced exponentially by the count.

roman-khimov · 2024-10-24T18:35:25Z

priced exponentially by the count.

Yeah, I had this thought as well, but you can easily avoid it with some number of transactions. Maybe they'd be a little less problematic than a single one, but still.

cschuchardt88 · 2024-10-25T19:57:18Z

src/Neo/SmartContract/ApplicationEngine.Runtime.cs

+        /// <summary>
+        /// The maximum number of notifications per application execution.
+        /// </summary>
+        public const int MaxNotificationCount = 512;


Use ExecutionEngineLimits Class engine.Limits.MaxNotificationCount

Notifications is a syscall, outside from VM

Its still an Engine Limitation, just cause the VM is splitted into two libraries shouldn't make it be to separate things.

We have MaxNotificationSize and MaxEventName declared in the same class as MaxNotificationCount, these three constants must be kept together.

src/Neo/SmartContract/Native/RoleManagement.cs

src/Neo/SmartContract/ApplicationEngine.Runtime.cs

AnnaShaleva added Discussion Initial issue state - proposed but not yet accepted Waiting for Review Hardfork labels Oct 23, 2024

AnnaShaleva requested review from shargon, cschuchardt88, Jim8y, vncoelho and roman-khimov October 23, 2024 16:10

AnnaShaleva mentioned this pull request Oct 23, 2024

【Oct.24】Core Dev Regular Meeting Proposal Discussion #3547

Closed

SmartContract: fix format

0c72e57

Signed-off-by: Anna Shaleva <[email protected]>

AnnaShaleva mentioned this pull request Oct 23, 2024

core: restrict the number of allowed SC notifications nspcc-dev/neo-go#3640

Open

vncoelho reviewed Oct 23, 2024

View reviewed changes

shargon reviewed Oct 23, 2024

View reviewed changes

src/Neo/SmartContract/ApplicationEngine.Runtime.cs Outdated Show resolved Hide resolved

Update src/Neo/SmartContract/ApplicationEngine.Runtime.cs

ee21427

shargon reviewed Oct 23, 2024

View reviewed changes

src/Neo/SmartContract/ApplicationEngine.Runtime.cs Show resolved Hide resolved

Avoid notification creation

4a6f36a

shargon reviewed Oct 24, 2024

View reviewed changes

roman-khimov mentioned this pull request Oct 24, 2024

Lower MaxBlockSystemFee limit #3552

Open

cschuchardt88 reviewed Oct 25, 2024

View reviewed changes

Merge branch 'HF_Echidna' into restrict-notifications-count

6fff362

Merge branch 'HF_Echidna' into restrict-notifications-count

4814339

cschuchardt88 reviewed Nov 17, 2024

View reviewed changes

src/Neo/SmartContract/Native/RoleManagement.cs Outdated Show resolved Hide resolved

fix format

9a657a5

Jim8y mentioned this pull request Nov 19, 2024

Add hardfork HF_Echidna #3454

Draft

10 tasks

shargon approved these changes Nov 20, 2024

View reviewed changes

shargon reviewed Nov 20, 2024

View reviewed changes

src/Neo/SmartContract/ApplicationEngine.Runtime.cs Show resolved Hide resolved

shargon reviewed Nov 20, 2024

View reviewed changes

src/Neo/SmartContract/ApplicationEngine.Runtime.cs Show resolved Hide resolved

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SmartContract: restrict the number of allowed notifications #3548

SmartContract: restrict the number of allowed notifications #3548

AnnaShaleva commented Oct 23, 2024

cschuchardt88 commented Oct 23, 2024

vncoelho Oct 23, 2024

AnnaShaleva Oct 23, 2024 •

edited

Loading

AnnaShaleva commented Oct 23, 2024

vncoelho Oct 23, 2024

cschuchardt88 Oct 23, 2024 •

edited

Loading

AnnaShaleva Oct 24, 2024

AnnaShaleva Oct 25, 2024

cschuchardt88 commented Oct 23, 2024 •

edited

Loading

Jim8y commented Oct 24, 2024 •

edited

Loading

AnnaShaleva commented Oct 24, 2024 •

edited

Loading

shargon left a comment

roman-khimov commented Oct 24, 2024

shargon commented Oct 24, 2024

roman-khimov commented Oct 24, 2024

cschuchardt88 Oct 25, 2024

shargon Oct 25, 2024

cschuchardt88 Oct 25, 2024

AnnaShaleva Oct 28, 2024

SmartContract: restrict the number of allowed notifications #3548

Are you sure you want to change the base?

SmartContract: restrict the number of allowed notifications #3548

Conversation

AnnaShaleva commented Oct 23, 2024

Description

Type of change

How Has This Been Tested?

Checklist:

cschuchardt88 commented Oct 23, 2024

Choose a reason for hiding this comment

AnnaShaleva Oct 23, 2024 • edited Loading

Choose a reason for hiding this comment

AnnaShaleva commented Oct 23, 2024

Choose a reason for hiding this comment

cschuchardt88 Oct 23, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cschuchardt88 commented Oct 23, 2024 • edited Loading

Jim8y commented Oct 24, 2024 • edited Loading

AnnaShaleva commented Oct 24, 2024 • edited Loading

shargon left a comment

Choose a reason for hiding this comment

roman-khimov commented Oct 24, 2024

shargon commented Oct 24, 2024

roman-khimov commented Oct 24, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

AnnaShaleva Oct 23, 2024 •

edited

Loading

cschuchardt88 Oct 23, 2024 •

edited

Loading

cschuchardt88 commented Oct 23, 2024 •

edited

Loading

Jim8y commented Oct 24, 2024 •

edited

Loading

AnnaShaleva commented Oct 24, 2024 •

edited

Loading