def compute_proof_for_lock(end_state: 'NettingChannelEndState',
secret: typing.secret,
lock: HashTimeLockState) -> UnlockProofState:
# forcing bytes because ethereum.abi doesn't work with bytearray
merkle_proof = compute_merkleproof_for(end_state.merkletree, lock.lockhash)
return UnlockProofState(
merkle_proof,
lock.encoded,
secret,
)
def test_start_end_attack(token_addresses, raiden_chain, deposit):
""" An attacker can try to steal tokens from a hub or the last node in a
path.
The attacker needs to use two addresses (A1 and A2) and connect both to the
hub H. Once connected a mediated transfer is initialized from A1 to A2
through H. Once the node A2 receives the mediated transfer the attacker
uses the known secret and reveal to close and settle the channel H-A2,
without revealing the secret to H's raiden node.
The intention is to make the hub transfer the token but for him to be
unable to require the token A1."""
amount = 30
token = token_addresses[0]
app0, app1, app2 = raiden_chain # pylint: disable=unbalanced-tuple-unpacking
token_network_identifier = views.get_token_network_identifier_by_token_address(
views.state_from_app(app0),
app0.raiden.default_registry.address,
token,
)
# the attacker owns app0 and app2 and creates a transfer through app1
identifier = 1
secret = pending_mediated_transfer(
raiden_chain,
token_network_identifier,
amount,
identifier,
)
secrethash = sha3(secret)
attack_channel = get_channelstate(app2, app1, token_network_identifier)
attack_transfer = None # TODO
attack_contract = attack_channel.external_state.netting_channel.address
hub_contract = (get_channelstate(
app1, app0,
token_network_identifier).external_state.netting_channel.address)
# the attacker can create a merkle proof of the locked transfer
lock = attack_channel.partner_state.get_lock_by_secrethash(secrethash)
unlock_proof = attack_channel.partner_state.compute_proof_for_lock(
secret, lock)
# start the settle counter
attack_balance_proof = attack_transfer.to_balanceproof()
attack_channel.netting_channel.channel_close(attack_balance_proof)
# wait until the last block to reveal the secret, hopefully we are not
# missing a block during the test
wait_until_block(app2.raiden.chain, attack_transfer.lock.expiration - 1)
# since the attacker knows the secret he can net the lock
attack_channel.netting_channel.unlock(
UnlockProofState(unlock_proof, attack_transfer.lock, secret), )
# XXX: verify that the secret was publicized
# at this point the hub might not know the secret yet, and won't be able to
# claim the token from the channel A1 - H
# the attacker settles the contract
app2.raiden.chain.next_block()
attack_channel.netting_channel.settle(token, attack_contract)
# at this point the attacker has the "stolen" funds
attack_contract = app2.raiden.chain.token_hashchannel[token][
attack_contract]
assert attack_contract.participants[
app2.raiden.address]['netted'] == deposit + amount
assert attack_contract.participants[
app1.raiden.address]['netted'] == deposit - amount
# and the hub's channel A1-H doesn't
hub_contract = app1.raiden.chain.token_hashchannel[token][hub_contract]
assert hub_contract.participants[app0.raiden.address]['netted'] == deposit
assert hub_contract.participants[app1.raiden.address]['netted'] == deposit
# to mitigate the attack the Hub _needs_ to use a lower expiration for the
# locked transfer between H-A2 than A1-H. For A2 to acquire the token
# it needs to make the secret public in the blockchain so it publishes the
# secret through an event and the Hub is able to require its funds
app1.raiden.chain.next_block()
# XXX: verify that the Hub has found the secret, close and settle the channel
# the hub has acquired its token
hub_contract = app1.raiden.chain.token_hashchannel[token][hub_contract]
assert hub_contract.participants[
app0.raiden.address]['netted'] == deposit + amount
assert hub_contract.participants[
app1.raiden.address]['netted'] == deposit - amount
def test_settled_lock(token_addresses, raiden_network, deposit):
""" Any transfer following a secret revealed must update the locksroot, so
that an attacker cannot reuse a secret to double claim a lock."""
app0, app1 = raiden_network
registry_address = app0.raiden.default_registry.address
token_address = token_addresses[0]
amount = 30
token_network_identifier = views.get_token_network_identifier_by_token_address(
views.state_from_app(app0),
app0.raiden.default_registry.address,
token_address,
)
address0 = app0.raiden.address
address1 = app1.raiden.address
deposit0 = deposit
deposit1 = deposit
token_proxy = app0.raiden.chain.token(token_address)
initial_balance0 = token_proxy.balance_of(address0)
initial_balance1 = token_proxy.balance_of(address1)
# Using a pending mediated transfer because this allows us to compute the
# merkle proof
identifier = 1
secret = pending_mediated_transfer(
raiden_network,
token_network_identifier,
amount,
identifier,
)
secrethash = sha3(secret)
# Compute the merkle proof for the pending transfer, and then unlock
channelstate_0_1 = get_channelstate(app0, app1, token_network_identifier)
lock = channel.get_lock(channelstate_0_1.our_state, secrethash)
unlock_proof = channel.compute_proof_for_lock(
channelstate_0_1.our_state,
secret,
lock,
)
claim_lock(raiden_network, identifier, token_network_identifier, secret)
# Make a new transfer
direct_transfer(app0, app1, token_network_identifier, amount, identifier=1)
RaidenAPI(app1.raiden).channel_close(
registry_address,
token_address,
app0.raiden.address,
)
# The direct transfer locksroot must not contain the unlocked lock, the
# unlock must fail.
netting_channel = app1.raiden.chain.netting_channel(channelstate_0_1.identifier)
with pytest.raises(Exception):
netting_channel.unlock(UnlockProofState(unlock_proof, lock.encoded, secret))
waiting.wait_for_settle(
app1.raiden,
app1.raiden.default_registry.address,
token_address,
[channelstate_0_1.identifier],
app1.raiden.alarm.wait_time,
)
expected_balance0 = initial_balance0 + deposit0 - amount * 2
expected_balance1 = initial_balance1 + deposit1 + amount * 2
assert token_proxy.balance_of(address0) == expected_balance0
assert token_proxy.balance_of(address1) == expected_balance1