GitHub Advisoryadvisory · crates.io

GHSA-mcmr-49x3-4jqm ckb type_id script resume may randomly fail

HIGH Published 2022-11-02 Modified 2022-11-02 Official page ↗

Ecosystem: crates.io
Packages: ckb
Severity: High
Reviewed: 2022-11-02

Affected packages

• crates.io ckb: >= 0.100.0, < 0.102.0 → fixed in 0.102.0

Description

Impact https://github.com/nervosnetwork/ckb/blob/v0.101.2/script/src/verify.rs#L871-L879 TypeIdSystemScript resume handle is not correct when max_cycles is not enough, `ScriptError::ExceededMaximumCycles` will be raised directly ranther than suspend as expect, and also because script_group execution order is random, so this will happen randomly.

References

https://github.com/nervosnetwork/ckb/security/advisories/GHSA-mcmr-49x3-4jqm web
https://github.com/nervosnetwork/ckb package
https://github.com/nervosnetwork/ckb/blob/v0.101.2/script/src/verify.rs#L871-L879 web