You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
There is a TODO for this in the code, but I am documenting this here as well since it is pretty important and allows to steal from a connector.
The connector accepts incoming transfers on paychans without checking if the channel is about to close. An attacker could 1) open a chan to the connector, 2) right away send a channel close tx, 3) wait until the settle delay is almost over and finally 4) send a transfer, which does leave the claim submitter with no time to send the claim.
Solution: If the channel watcher detects that a channel is about to close, he writes this info back into the DB. The middleware that handles incoming transfers could then read the channel details from the DB and reject incoming transfers on closing channels.
The text was updated successfully, but these errors were encountered:
dappelt
changed the title
Don't accept incoming transfers on a paychan that is about to close
[XRP] Don't accept incoming transfers on a paychan that is about to close
Nov 29, 2017
There is a TODO for this in the code, but I am documenting this here as well since it is pretty important and allows to steal from a connector.
The connector accepts incoming transfers on paychans without checking if the channel is about to close. An attacker could 1) open a chan to the connector, 2) right away send a channel close tx, 3) wait until the settle delay is almost over and finally 4) send a transfer, which does leave the claim submitter with no time to send the claim.
Solution: If the channel watcher detects that a channel is about to close, he writes this info back into the DB. The middleware that handles incoming transfers could then read the channel details from the DB and reject incoming transfers on closing channels.
The text was updated successfully, but these errors were encountered: