fix: Remove hash bit masking in Vector pallet verification #715
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR fixes a critical security vulnerability in the Vector pallet's verification logic where input and output hashes were being partially masked during verification. The masking of the first 3 bits of the hashes significantly weakened the cryptographic security of the verification process.
Changes
verify
method inverifier.rs
Security Impact
Severity: High
Scope: All cross-chain message verification
Attack Vectors:
Testing
Backwards Compatibility
This change is backwards incompatible with existing proofs that may have relied on the bit masking behavior. A network upgrade will be required to deploy this fix.
Upgrade Path
Additional Notes
This fix is critical for maintaining the security of cross-chain message verification. Please review and merge with high priority.
Checklist
cargo test
.cargo fmt
.cargo build --release
andcargo build --release --features runtime-benchmarks
.cargo clippy
.