core: prohibit Conflicts attribute duplicate

Close #4289.

Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>

Author: AnnaShaleva

pkg/core/blockchain.go

@@ -3019,6 +3019,7 @@ func (bc *Blockchain) CalculateAttributesFee(tx *transaction.Transaction) int64
 }
 
 func (bc *Blockchain) verifyTxAttributes(d *dao.Simple, tx *transaction.Transaction, isPartialTx bool) error {
+	var conflictsAttrs []transaction.Attribute
 	for i := range tx.Attributes {
 		switch attrType := tx.Attributes[i].Type; attrType {
 		case transaction.HighPriority:
@@ -3078,6 +3079,18 @@ func (bc *Blockchain) verifyTxAttributes(d *dao.Simple, tx *transaction.Transact
 			}
 		case transaction.ConflictsT:
 			conflicts := tx.Attributes[i].Value.(*transaction.Conflicts)
+			if conflictsAttrs == nil {
+				conflictsAttrs = tx.GetAttributes(transaction.ConflictsT)
+			}
+			var dup bool
+			for _, c := range conflictsAttrs {
+				if c.Value.(*transaction.Conflicts).Hash.Equals(conflicts.Hash) {
+					if dup {
+						return fmt.Errorf("%w: duplicate Conflicts attribute %s", ErrInvalidAttribute, conflicts.Hash.StringLE())
+					}
+					dup = true
+				}
+			}
 			// Only fully-qualified dao.ErrAlreadyExists error bothers us here, thus, we
 			// can safely omit the signers, current index and MTB arguments to HasTransaction call to improve performance a bit.
 			if err := bc.dao.HasTransaction(conflicts.Hash, nil, 0, 0); errors.Is(err, dao.ErrAlreadyExists) {

pkg/core/blockchain_neotest_test.go

@@ -1977,6 +1977,14 @@ func TestBlockchain_VerifyTx(t *testing.T) {
 				require.NoError(t, err)
 			})
 			t.Run("enabled", func(t *testing.T) {
+				t.Run("duplicate", func(t *testing.T) {
+					conflict := random.Uint256()
+					tx := getConflictsTx(e, conflict, conflict)
+
+					err := bc.VerifyTx(tx)
+					require.ErrorIs(t, err, core.ErrInvalidAttribute)
+					require.ErrorContains(t, err, fmt.Sprintf("duplicate Conflicts attribute %s", conflict.StringLE()))
+				})
 				t.Run("dummy on-chain conflict", func(t *testing.T) {
 					t.Run("on-chain conflict signed by malicious party", func(t *testing.T) {
 						tx := newTestTx(t, h, testScript)