Skip to content

Conversation

kianenigma
Copy link
Contributor

That can re-instate them in the bags-list pallet

Identified by https://github.com/paritytech-secops/srlabs_findings/issues/559

While no severe consequence, this bug could cause non-validator and non-nominator stakers to retain a spot in the bags-list pallet, preventing other legit nominators/validators from taking their place.

Note that previously, this was not a possibility, because staking would always issue a T::VoterList::on_remove when someone chills, ensuring they are removed from the list. Moreover, an older version of pallet_bags_list::Pallet::rebag didn't allow new nodes to be added, only the score of existing nodes to be adjusted.

But, in recent versions of bags-list, we added a Lock ability that would block any changes to the bags list (during the election snapshot phase). This also had us update the rebag transaction to add or remove nodes from the list, which opened the door to this issue.

@kianenigma kianenigma requested a review from a team as a code owner October 3, 2025 13:37
@kianenigma kianenigma added the T2-pallets This PR/Issue is related to a particular pallet. label Oct 3, 2025
@sigurpol sigurpol self-requested a review October 3, 2025 13:40
@paritytech-workflow-stopper
Copy link

All GitHub workflows were cancelled due to failure one of the required jobs.
Failed workflow url: https://github.com/paritytech/polkadot-sdk/actions/runs/18223885035
Failed job name: test-linux-stable

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
T2-pallets This PR/Issue is related to a particular pallet.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant