Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix the oz audit issuse l-02 #194

Merged
merged 1 commit into from
Feb 8, 2025
Merged

fix the oz audit issuse l-02 #194

merged 1 commit into from
Feb 8, 2025

Conversation

adam-xu-mantle
Copy link
Contributor

@adam-xu-mantle adam-xu-mantle commented Jan 23, 2025

L-02 Inadequate Handling of Single Large Data Frames in blobTxCandidates

In the blobTxCandidates function, the code assumes that data exceeding the size limit (se.MaxBlobDataSize * MaxblobNum) results from the aggregation of multiple frames. However, it does not account for the possibility that a single frame (frameData) could individually exceed the maximum size. When this occurs, the function appends the oversized frame to dataInTx and proceeds without any special handling, which may lead to unintended behavior during blob creation.
If a single frame exceeds the maximum blob size, the function does not split it into smaller chunks or handle the error explicitly. This can result in the generation of transaction candidates with empty blobs or transaction candidates with an amount of blobs which exceeds the configured amount of maximum blobs (MaxblobNum), which is currently set to 4.
We recommend to introduce explicit handling for single frames that exceed the maximum size. Before appending a frame to dataInTx, check whether the frame itself exceeds the size limit. If it does, log an error and return an appropriate error message. Alternatively, implement logic to split oversized frames into smaller chunks before proceeding. Another solution could be to ensure a single frame will always fit in a single blob transaction by enforcing the configured MaxFrameSize is smaller than the maximum size (se.MaxBlobDataSize * MaxblobNum). Adding this check will ensure robust handling of all edge cases.

Copy link

github-actions bot commented Feb 7, 2025

This PR is stale because it has been open 14 days with no activity. Remove stale label or comment or this will be closed in 5 days.

@github-actions github-actions bot added the Stale label Feb 7, 2025
@adam-xu-mantle adam-xu-mantle merged commit d4fbcd0 into develop Feb 8, 2025
0 of 3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants