protocol/state: duplicate, overlapping nonces possible
Closed this issue · 4 comments
The tx max and min times should not be used for nonce validation, but rather the time range associated with the nonce itself because the nonce time range can be greater than and encompass the tx time range.
Additionally, just comparing the max times is not sufficient. The nonces should not be able to overlap, so the max time of the nonce in the state should be less than the min time of the nonce in the transaction.
It may be worth not even doing the time comparison, but instead checking presence and relying on block timestamp based expiration.
Relevant Code:
https://github.com/chain/chain/blob/23f405c000f934ffe264781d8337a69916ab4028/protocol/state/snapshot.go#L74-L81
See also #728 (comment)
Agreed, thanks
That's in response to the first point. I'm not sure I understand the second. As long as the nonces have different maxtimes, they will be unique, since the maxtime is hashed into the nonce. So isn't that fine?
Yeah, they should be unique. The pr changes from a time check to a presence check.