Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Wrong VARINT encoding for Transaction Count field in Blocktemplate #39

Open
DeckerSU opened this issue Oct 22, 2018 · 2 comments
Open

Comments

@DeckerSU
Copy link

DeckerSU commented Oct 22, 2018

We have wrong varint encoding here https://github.com/z-classic/node-stratum-pool/blob/master/lib/blockTemplate.js#L91 for transaction count in block. Let's see results of default implementation:

1. this.txCount = 15, varInt = 0f
2. this.txCount = 127, varInt = 7f
3. this.txCount = 128, varInt = fd80
4. this.txCount = 256, varInt = fd0100
5. this.txCount = 777, varInt = fd0309

This is totally wrong for cases 3-5 and block with this encoding in Transaction Count field will be rejected with block decode failed error. Should be:

1. this.txCount = 15, varInt = 0f
2. this.txCount = 127, varInt = 7f
3. this.txCount = 128, varInt = fd8000
4. this.txCount = 256, varInt = fd0001
5. this.txCount = 777, varInt = fd0903

Here is a fix:

if (this.txCount <= 0x7f){
    var varInt = new Buffer(txCount, 'hex');
}
else if (this.txCount <= 0x7fff){
    if (txCount.length == 2) txCount = "00" + txCount;
    var varInt = new Buffer.concat([Buffer('FD', 'hex'), util.reverseBuffer(new Buffer(txCount, 'hex'))]);
}
@Alrighttt
Copy link

This should be considered a security related bug. One can prevent a pool from mining blocks by making the mempool size between 129-255

@DeckerSU
Copy link
Author

DeckerSU commented Nov 6, 2018

Updated fix:

        /* https://en.bitcoin.it/wiki/Protocol_documentation#Variable_length_integer */
        if (this.txCount < 0xfd){
            var varInt = new Buffer(txCount, 'hex');
        }
        else if (this.txCount <= 0xffff){
            var varInt = new Buffer.concat([Buffer('FD', 'hex'), util.reverseBuffer(new Buffer(txCount, 'hex'))]);
        }

Example:

this.txCount = 183, varInt = b7 
this.txCount = 1344, varInt = fd4005

Format of VARINT in Bitcoin explained here - https://en.bitcoin.it/wiki/Protocol_documentation#Variable_length_integer .

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants