mitigate-involuntary-replay-attack-in-unshield

Cargo.lock

@@ -1183,7 +1183,7 @@ dependencies = [
 [[package]]
 name = "ias-verify"
 version = "0.1.0"
-source = "git+https://github.com/scs/pallet-substratee-registry.git?tag=v0.6.7-sub2.0.0-alpha.7#c4bcb69975b96a52a68b95a852d3c4a02c84c241"
+source = "git+https://github.com/scs/pallet-substratee-registry.git?tag=v0.6.8-sub2.0.0-alpha.7#9adb121943960f983e6261d64c74f7d4bba37918"
 dependencies = [
  "base64",
  "chrono",
@@ -1968,8 +1968,8 @@ dependencies = [
 
 [[package]]
 name = "pallet-substratee-registry"
-version = "0.6.7-sub2.0.0-alpha.7"
-source = "git+https://github.com/scs/pallet-substratee-registry.git?tag=v0.6.7-sub2.0.0-alpha.7#c4bcb69975b96a52a68b95a852d3c4a02c84c241"
+version = "0.6.8-sub2.0.0-alpha.7"
+source = "git+https://github.com/scs/pallet-substratee-registry.git?tag=v0.6.8-sub2.0.0-alpha.7#9adb121943960f983e6261d64c74f7d4bba37918"
 dependencies = [
  "frame-support",
  "frame-system",
@@ -3818,8 +3818,8 @@ dependencies = [
 
 [[package]]
 name = "substratee-node-runtime"
-version = "0.6.5-sub2.0.0-alpha.7"
-source = "git+https://github.com/scs/substraTEE-node?tag=v0.6.5-sub2.0.0-alpha.7#6b0ef0b840c34e0a9beb418125a6dc7904a7862c"
+version = "0.6.6-sub2.0.0-alpha.7"
+source = "git+https://github.com/scs/substraTEE-node?tag=v0.6.6-sub2.0.0-alpha.7#53c2c0330ebf55b869f2fcd106490cff9a466417"
 dependencies = [
  "frame-executive",
  "frame-support",

client/Cargo.toml

@@ -53,7 +53,7 @@ default-features=false
 
 [dependencies.substratee-node-runtime]
 git = "https://github.com/scs/substraTEE-node"
-tag = "v0.6.5-sub2.0.0-alpha.7"
+tag = "v0.6.6-sub2.0.0-alpha.7"
 package = "substratee-node-runtime"
 
 [dependencies.substratee-stf]

client/src/main.rs

@@ -515,9 +515,7 @@ fn send_request(matches: &ArgMatches<'_>, call: TrustedCallSigned) -> Option<Vec
     decoder
         .register_type_size::<Hash>("ShardIdentifier")
         .unwrap();
-    decoder
-        .register_type_size::<(Hash, Vec<u8>)>("Request")
-        .unwrap();
+    decoder.register_type_size::<Hash>("H256").unwrap();
 
     loop {
         let ret: CallConfirmedArgs = _chain_api
@@ -529,7 +527,7 @@ fn send_request(matches: &ArgMatches<'_>, call: TrustedCallSigned) -> Option<Vec
             )
             .unwrap()
             .unwrap();
-        let expected = blake2_256(&call_encoded);
+        let expected = H256::from(blake2_256(&call_encoded));
         info!("callConfirmed event received");
         debug!("Expected stf call Hash: {:?}", expected);
         debug!("Confirmed stf call Hash: {:?}", ret.payload);
@@ -543,7 +541,7 @@ fn send_request(matches: &ArgMatches<'_>, call: TrustedCallSigned) -> Option<Vec
 #[derive(Decode)]
 struct CallConfirmedArgs {
     signer: AccountId,
-    payload: Vec<u8>,
+    payload: H256,
 }
 
 fn listen(matches: &ArgMatches<'_>) {
@@ -619,7 +617,7 @@ fn listen(matches: &ArgMatches<'_>) {
 }
 
 // subscribes to he substratee_registry events of type CallConfirmed
-pub fn subscribe_to_call_confirmed<P: Pair>(api: Api<P>) -> Vec<u8>
+pub fn subscribe_to_call_confirmed<P: Pair>(api: Api<P>) -> H256
 where
     MultiSignature: From<P::Signature>,
 {
@@ -649,7 +647,7 @@ where
                     ) = &pe
                     {
                         println!("[+] Received confirm call from {}", sender);
-                        return payload.to_vec();
+                        return payload.clone().to_owned();
                     } else {
                         debug!(
                             "received unknown event from SubstraTeeRegistry: {:?}",

enclave/src/lib.rs

@@ -385,12 +385,16 @@ fn handle_shield_funds_xt(
     debug!("decrypt the call");
     let rsa_keypair = rsa3072::unseal_pair()?;
     let account_vec = rsa3072::decrypt(&account_encrypted, &rsa_keypair)?;
-    let account = AccountId::decode(&mut account_vec.as_slice()).sgx_error()?;
+    let account = AccountId::decode(&mut account_vec.as_slice())
+        .sgx_error_with_log("[ShieldFunds] Could not decode account")?;
 
     if let Err(e) = Stf::execute(
         &mut state,
-        TrustedCall::balance_shield(account, amount),
-        Default::default(),
+        TrustedCallSigned::new(
+            TrustedCall::balance_shield(account, amount),
+            0,
+            Default::default(),
+        ),
         calls,
     ) {
         error!("Error performing Stf::execute. Error: {:?}", e);
@@ -402,7 +406,7 @@ fn handle_shield_funds_xt(
         (
             xt_call,
             shard,
-            blake2_256(&xt.encode()).to_vec(),
+            blake2_256(&xt.encode()),
             state_hash.encode(),
         )
             .encode(),
@@ -448,7 +452,7 @@ fn handle_call_worker_xt(
     let mut state = state::load(&shard)?;
 
     debug!("Update STF storage!");
-    let requests = Stf::get_storage_hashes_to_update(&stf_call_signed.call)
+    let requests = Stf::get_storage_hashes_to_update(&stf_call_signed)
         .into_iter()
         .map(|key| WorkerRequest::ChainStorage(key, Some(header.hash())))
         .collect();
@@ -486,12 +490,7 @@ fn handle_call_worker_xt(
     Stf::update_storage(&mut state, update_map);
 
     debug!("execute STF");
-    if let Err(e) = Stf::execute(
-        &mut state,
-        stf_call_signed.call,
-        stf_call_signed.nonce,
-        calls,
-    ) {
+    if let Err(e) = Stf::execute(&mut state, stf_call_signed, calls) {
         error!("Error performing Stf::execute. Error: {:?}", e);
         return Ok(());
     }
@@ -503,7 +502,7 @@ fn handle_call_worker_xt(
     debug!("Call hash 0x{}", hex::encode_hex(&call_hash));
 
     calls.push(OpaqueCall(
-        (xt_call, shard, call_hash.to_vec(), state_hash.encode()).encode(),
+        (xt_call, shard, call_hash, state_hash.encode()).encode(),
     ));
 
     Ok(())

stf/src/sgx.rs

@@ -12,8 +12,10 @@ use sp_io::SgxExternalitiesTrait;
 use sp_runtime::traits::Dispatchable;
 
 use crate::{
-    AccountId, State, Stf, TrustedCall, TrustedGetter, SUBSRATEE_REGISTRY_MODULE, UNSHIELD,
+    AccountId, State, Stf, TrustedCall, TrustedCallSigned, TrustedGetter,
+    SUBSRATEE_REGISTRY_MODULE, UNSHIELD,
 };
+use sp_core::blake2_256;
 
 /// Simple blob that holds a call in encoded format
 #[derive(Clone, Debug)]
@@ -77,11 +79,10 @@ impl Stf {
 
     pub fn execute(
         ext: &mut State,
-        call: TrustedCall,
-        _nonce: u32,
+        call: TrustedCallSigned,
         calls: &mut Vec<OpaqueCall>,
     ) -> Result<(), StfError> {
-        ext.execute_with(|| match call {
+        ext.execute_with(|| match call.call {
             TrustedCall::balance_set_balance(root, who, free_balance, reserved_balance) => {
                 Self::ensure_root(root)?;
                 sgx_runtime::BalancesCall::<Runtime>::set_balance(
@@ -108,6 +109,7 @@ impl Stf {
                         beneficiary,
                         value,
                         shard,
+                        blake2_256(&call.encode()),
                     )
                         .encode(),
                 ));
@@ -185,17 +187,17 @@ impl Stf {
         }
     }
 
-    pub fn get_storage_hashes_to_update(call: &TrustedCall) -> Vec<Vec<u8>> {
+    pub fn get_storage_hashes_to_update(call: &TrustedCallSigned) -> Vec<Vec<u8>> {
         let mut key_hashes = Vec::new();
-        match call {
+        match call.call {
             TrustedCall::balance_set_balance(account, _, _, _) => {
-                key_hashes.push(nonce_key_hash(account)) // dummy, actually not necessary
+                key_hashes.push(nonce_key_hash(&account)) // dummy, actually not necessary
             }
             TrustedCall::balance_transfer(account, _, _) => {
-                key_hashes.push(nonce_key_hash(account)) // dummy, actually not necessary
+                key_hashes.push(nonce_key_hash(&account)) // dummy, actually not necessary
             }
             TrustedCall::balance_unshield(account, _, _, _) => {
-                key_hashes.push(nonce_key_hash(account))
+                key_hashes.push(nonce_key_hash(&account))
             }
             TrustedCall::balance_shield(_, _) => debug!("No storage updates needed..."),
         };

substratee-node-primitives/Cargo.toml

@@ -18,7 +18,7 @@ optional = true
 
 [dependencies.substratee-node-runtime]
 git = "https://github.com/scs/substraTEE-node"
-tag = "v0.6.5-sub2.0.0-alpha.7"
+tag = "v0.6.6-sub2.0.0-alpha.7"
 package = "substratee-node-runtime"
 optional = true
 default-features = false

substratee-node-primitives/src/lib.rs

@@ -17,7 +17,7 @@ pub struct Request {
     pub cyphertext: Vec<u8>,
 }
 
-pub type SubstrateeConfirmCallFn = ([u8; 2], ShardIdentifier, Vec<u8>, Vec<u8>);
+pub type SubstrateeConfirmCallFn = ([u8; 2], ShardIdentifier, H256, Vec<u8>);
 pub type ShieldFundsFn = ([u8; 2], Vec<u8>, u128, ShardIdentifier);
 pub type CallWorkerFn = ([u8; 2], Request);
 

worker/Cargo.toml

@@ -46,7 +46,7 @@ path = "worker-api"
 
 [dependencies.substratee-node-runtime]
 git = "https://github.com/scs/substraTEE-node"
-tag = "v0.6.5-sub2.0.0-alpha.7"
+tag = "v0.6.6-sub2.0.0-alpha.7"
 package = "substratee-node-runtime"
 
 [dependencies.sp-finality-grandpa]

worker/src/main.rs

@@ -398,6 +398,13 @@ fn print_events(events: Events, _sender: Sender<String>) {
                         debug!("    For:    {:?}", incognito_account);
                         println!();
                     }
+                    substratee_node_runtime::substratee_registry::RawEvent::UnshieldedFunds(
+                        incognito_account,
+                    ) => {
+                        println!("[+] Received UnshieldedFunds event");
+                        debug!("    For:    {:?}", incognito_account);
+                        println!();
+                    }
                     _ => {
                         info!("Ignoring unsupported substratee_registry event");
                     }