Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[NCC-E008263-4VP] Unchecked Accesses to Data Structures #457

Closed
Tracked by #451
conradoplg opened this issue Jul 26, 2023 · 0 comments · Fixed by #477
Closed
Tracked by #451

[NCC-E008263-4VP] Unchecked Accesses to Data Structures #457

conradoplg opened this issue Jul 26, 2023 · 0 comments · Fixed by #477
Assignees
Milestone

Comments

@conradoplg
Copy link
Contributor

In multiple instances, dictionary are accessed directly, which leads to panics if the key is not present. See report for more details.

Also, in aggregate(), we should make sure that the 3 arguments have matching sets of identifiers.

Fix those:

  • It's probably better to avoid indexing directly altogether and use .get() instead, handling the error. Try enabling the indexing_slicing lint (possibly with an exception in test code)
  • Add a validation in aggregate() to make sue the identifier sets are consistent (signing_package.signing_commitments and signature_shares should have equal keys, and they should be a subset of pubkeys.signer_pubkeys)
@conradoplg conradoplg self-assigned this Aug 15, 2023
@mergify mergify bot closed this as completed in #477 Aug 16, 2023
@mpguerra mpguerra added this to the FROST Audit milestone Aug 24, 2023
@mpguerra mpguerra added this to FROST Aug 24, 2023
@mpguerra mpguerra moved this to Done in FROST Aug 24, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Archived in project
Development

Successfully merging a pull request may close this issue.

2 participants