Add synthetic transaction execution and restrict inline contract operations - #3644
Merged
Merged
Conversation
jason-aelf
commented
Sep 1, 2026
jason-aelf
commented
Collaborator
- Add synthetic execution for transactions targeting the affected contract in normal and read-only execution paths.
- Disallow inline contract deployment and updates on side chains.
…ay deterministic The bypass matched only on To == the malicious contract and applied at every execution depth and on the read-only path, so it changed the result of ANY call to the contract -- including a synchronous cross-contract Context.Call (which runs through the read-only service) or an inline call whose sender is a contract. Because the contract only leaks the node key when Context.Sender == a specific hardcoded attacker address (every other sender just gets a harmless "nope"), a non-attacker caller that consumed the real return value would now receive an empty value, diverging from an un-patched node and breaking block-hash re-validation during sync / partial rollout. Match From == the attacker address (== Context.Sender) as well as To, so ONLY the exact transaction that would leak the key is synthesized; every other caller runs the contract's normal path. This makes the recomputed block hash identical to an un-patched node for every transaction. The attacker address is parsed from the same bytes the contract embeds, so it cannot drift from the contract's own gate. Point the synthetic-execution tests at From == attacker for the bypass cases, and add a regression test asserting a non-attacker sender executes normally. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…calls stay deterministic" This reverts commit 89fed1c. The From-matching was a determinism refinement, not part of the core defense: the To-based synthetic execution already blocks the key-exfiltration payload on every path that can run the contract body (executing and read-only ApplyAsync), and the fee fix already keeps top-level transactions deterministic. Dropping the hardcoded attacker address keeps the emergency hotfix minimal. The only residual it addressed -- a synchronous cross-contract Context.Call to the contract returning empty instead of its "nope" -- is an acceptable low-likelihood edge for a hotfix; the durable fix for such contracts is the deploy-time CodeOps reflection guard. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #3644 +/- ##
==========================================
+ Coverage 87.81% 90.64% +2.83%
==========================================
Files 680 681 +1
Lines 26310 26325 +15
Branches 2370 2370
==========================================
+ Hits 23104 23863 +759
+ Misses 3090 2346 -744
Partials 116 116
🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.