L1 - Artela

In the GetTransactionReceipt function, the gasUsed field of the transaction receipt is incorrectly set to the gas limit of the transaction (`txData.GetGas()`) instead of the actual gas used by the transaction (`res.GasUsed`).

Current implementation:

"gasUsed": hexutil.Uint64(txData.GetGas())

Replace txData.GetGas() with res.GasUsed in the gasUsed field assignment.

SOLVED: The Artela team solved the issue by implementing the suggested recommendation.

Docker containers generally run with root privileges by default. This allows for unrestricted container management, meaning a user could install system packages, edit configuration files, bind privileged ports, etc. During static analysis, it was observed that the docker image is maintained through the root user.

FROM golang:1.21.5-bullseye as build-env

# Install minimum necessary dependencies
ENV PACKAGES curl make git libc-dev bash gcc
RUN apt-get update && apt-get upgrade -y && \
    apt-get install -y $PACKAGES

# Set working directory for the source copy
WORKDIR /go/src/github.com/artela-network

# Add source files
COPY ./artela ./artela

# Reset the working directory for the build
WORKDIR /go/src/github.com/artela-network/artela

# disable optimisation and strip for remote debugging
ENV COSMOS_BUILD_OPTIONS "nostrip,nooptimization"

# build artelad
RUN make build

# Final image
FROM golang:1.21.5-bullseye as final

WORKDIR /

RUN apt-get update && \
    go install github.com/go-delve/delve/cmd/dlv@latest

# Add GO Bin to PATH
ENV PATH "/go/bin:${PATH}"

# Copy over binaries from the build-env
COPY --from=build-env /go/src/github.com/artela-network/artela/build/artelad /
COPY --from=build-env /go/src/github.com/artela-network/artela/scripts/start-artela.sh /

EXPOSE 26656 26657 1317 9090 8545 8546 19211

# Run artelad by default, omit entrypoint to ease using container with artelad
ENTRYPOINT ["/bin/bash", "-c"]

To mitigate this issue, it is recommended to follow the principle of least privilege and run the container as a non-root user. This can be achieved by creating a dedicated user within the Dockerfile and running the application as that user.

RISK ACCEPTED: The Artela team accepted the risk of the issue.

A vulnerability was discovered with the implementation of the HTTP/2 protocol in Golang prior to 1.21.9 and 1.22.2 versions. The current version used in app chain is 1.21.

An attacker can cause the HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. This causes excessive CPU consumption of the receiver device since there is no sufficient limitation on the amount of frames. Thus, It could be exploited to cause DoS.

Please note that, many HTTP/2 implementations (including Golang) did not properly limit the amount of CONTINUATION frames within a single stream.

References:

https://kb.cert.org/vuls/id/421644

https://www.cve.org/CVERecord?id=CVE-2023-45288

The issue is fixed in both Golang 1.21.9 and 1.22.2. However, If you are intending to use 1.21.X, It is recommended upgrading to 1.21.11 (the latest of 1.21.X) since it has some other security/bug fixes in net/http package.

ACKNOWLEDGED: The Artela team acknowledged the issue.