Summary
In adnl/adnl-local-id.cpp:87, recent_inbound_peers.insert(packet.from_short())
executes before signature verification at adnl-peer.cpp:265.
An attacker can fill the 60-slot set with forged from_short() values,
blocking new peers from their source IP for 60 seconds.
Suggested fix
Move insert() to after signature verification, or validate
from_short() against the verified sender identity.
Affected commit
a6298cf
Summary
In
adnl/adnl-local-id.cpp:87,recent_inbound_peers.insert(packet.from_short())executes before signature verification at
adnl-peer.cpp:265.An attacker can fill the 60-slot set with forged
from_short()values,blocking new peers from their source IP for 60 seconds.
Suggested fix
Move
insert()to after signature verification, or validatefrom_short()against the verified sender identity.Affected commit
a6298cf