test(twap-monitor): cover a fully fabricated ConditionalOrderCreated log - #674
Open
lgahdl wants to merge 1 commit into
Open
test(twap-monitor): cover a fully fabricated ConditionalOrderCreated log#674lgahdl wants to merge 1 commit into
lgahdl wants to merge 1 commit into
Conversation
decode_conditional_order_created only checks topic-0 (already enforced by the engine's address+topic-0 filter); nothing checks that the log corresponds to a real chain inclusion. The same is true on the poll side: poll_one/decode_return blindly ABI-decode whatever the eth_call response contains. A malicious/compromised RPC controls both the log delivery and the eth_call response, so it can drive the entire pipeline - index a watch, report it poll-ready, trigger a real submission attempt - purely from fabricated data. This test proves the chain end to end: a ConditionalOrderCreated log for an invented (owner, ConditionalOrderParams) pair with no on-chain backing is persisted as a watch unconditionally, and a fabricated "ready" eth_call response then drives a real submit attempt to the venue, with no local check anywhere in on_chain_logs, the poll path, or submit_ready refusing it on the RPC's say-so alone. No production code changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reproduction for #673.
decode_conditional_order_createdonly checks topic-0 — already enforced by the engine's address+topic-0 chain-log filter — and never checks that the log corresponds to a real chain inclusion. The same is true on the poll side:poll_one/decode_returnblindly ABI-decode whatever theeth_callresponse contains. A malicious/compromised RPC provider controls both the log delivery and theeth_callresponse, so it can drive the entire pipeline — index a watch, report it poll-ready, trigger a real submission attempt — purely from fabricated data, with nothing in the module ever cross-checking the RPC's honesty.What this adds
One test,
fabricated_create_log_drives_a_real_submit_attempt_with_no_local_cross_check, proving the chain end to end:ConditionalOrderCreatedlog for an invented(owner, ConditionalOrderParams)pair, with no on-chain backing whatsoever, is fed toon_chain_logs→ confirmed the watch is persisted unconditionally.eth_callresponse (arbitraryGPv2OrderData+ a signature that verifies nothing) is programmed for the corresponding poll.on_blockis dispatched → confirmed a real submit attempt reaches the venue (venue.submit_count() == 1), with no local check anywhere inon_chain_logs, the poll path, orsubmit_readyrefusing it.No production code changes — this is reproduction/regression coverage for #673, which has the full writeup and a proportionate suggested improvement (documenting the trust boundary explicitly, plus a venue-denial-rate signal as an operational indicator of a compromised RPC — full cryptographic verification is out of proportion for a keeper module).
Testing
cargo test --manifest-path modules/twap-monitor/Cargo.toml: 26/26 pass (25 pre-existing + the new one), no regressions.AI Assistance: Claude Code was used for the investigation and this test, as part of a follow-up TWAP-flow red-team pass.