FISCO BCOS Transaction Pool Synchronization Vulnerability Allowing Denial-of-Service

A vulnerability in FISCO BCOS version 3.11.0 relates to the synchronization of the transaction pool. This issue can be exploited when a malicious node joins the blockchain network after modifying its codebase to set a large 'min_seal_time' value. The vulnerability causes transactions to hang, disrupting the entire blockchain's transaction process. The problem arises because the 'min_seal_time' parameter, which should be a consensus value agreed upon by all nodes, can be manipulated by individual nodes, leading to potential denial-of-service conditions.

Impact

Exploitation of this vulnerability can cause transaction processes to hang indefinitely, preventing the completion of legitimate user transactions and disrupting overall network consensus.

Reproduction

To reproduce this vulnerability, start a four-node FISCO BCOS cluster and conduct a stress test. Then, modify the 'min_seal_time' value in the 'config.ini' file of one node, setting it to a large value. After running the stress test, observe that transactions may hang and only resume after the modified 'min_seal_time' has elapsed. If the 'min_seal_time' is set excessively high, transactions can become permanently stalled, with no results returned to users.

Remediation

It is recommended to include the 'min_seal_time' parameter in the chain configuration file 'config.genesis', ensuring that all nodes agree on the value at startup. This would prevent individual nodes from making changes that could disrupt the entire network.