Gridcoin-research: Contracts can be deleted by replay attack
All contracts, except type beacon poll and vote can be deleted, and re-issued if they were deleted, without the knowledge of private key. The "Action" <MA> field can be either "A" for add or "D" for delete, but this information is not signed. So the whole contract can be copied, A replaced for D and sent again. Yes, most contracts are signed with key-par, which private key is public in the code (go figure).
tomasbrod
All 2 comments
This would be a critical vulnerability, if one could Delete a whitelisted Project such as Rosetta, without knowledge of the Private Key that our admin (Quez) holds. According to the description above, the attacker could Delete the Rosetta project in testnet or Prod.
I assert that you cannot delete Rosetta, as the private key is not in the code. The private key in the code is for Voting (yet voting now requires the public key in the code plus the users beacon signature).
Please test in testnet and confirm this issue should be closed.
Erkan, please do more due diligence before spreading misinformation in order to profit off of it.
gridcoin
on 21 Sep 2017
This is fixed in Fern.
jamescowens
on 17 Jun 2020
Related issues
TheCharlatan
路
21Comments
jamescowens
路
43Comments
3ullShark
路
54Comments
nateonthenet
路
20Comments
mr-snipes
路
31Comments
Most helpful comment
This would be a critical vulnerability, if one could Delete a whitelisted Project such as Rosetta, without knowledge of the Private Key that our admin (Quez) holds. According to the description above, the attacker could Delete the Rosetta project in testnet or Prod.
I assert that you cannot delete Rosetta, as the private key is not in the code. The private key in the code is for Voting (yet voting now requires the public key in the code plus the users beacon signature).
Please test in testnet and confirm this issue should be closed.
Erkan, please do more due diligence before spreading misinformation in order to profit off of it.