Nxt source code flaw reports

[Come-from-Beyond]

Could you please elaborate on how its a feature and not a flaw.

I prefer to wait until someone explains why it's a flaw.

[goingDeaf]

Building on previous posts.

The previous block is always read from the lastBlock ala getBaseTarget.

If a malicious person were to re-write the client at pushBlock so that previous block was offset by 1 at generation time so then verifyGenerationSignature would honour this previous block and skip the actual previous block, meaning that there would be a block with missing transactions making double spending possible.

[gimre]

Building on previous posts.

The previous block is always read from the lastBlock ala getBaseTarget.

If a malicious person were to re-write the client at pushBlock so that previous block was offset by 1 at generation time so then verifyGenerationSignature would honour this previous block and skip the actual previous block, meaning that there would be a block with missing transactions making double spending possible.

And what makes you think, any other peer in network would accept such block...

[jkoil]

Is the 3rd flaw still running free out there?
...though NXT source is public?

  https://bitbucket.org/JeanLucPicard  

[Come-from-Beyond]

Is the 3rd flaw still running free out there?
...though NXT source is public?

  https://bitbucket.org/JeanLucPicard  

U still have time to find it and get 100K reward.

[jkoil]

Is the 3rd flaw still running free out there?
...though NXT source is public?

  https://bitbucket.org/JeanLucPicard  

U still have time to find it and get 100K reward.

absolutely great.
In that case I start focusing on that flaw, coz I just got my first java code working
and therefore I'm qualified java dev now -  I shall have a date with that flaw  :
We shall meet in the place where there is no darkness

[Evil-Knievel]

This message was too old and has been purged

[Come-from-Beyond]

Could you make this clearer?

Only after 3rd of April.

[jkoil]

Is this "getLastBlock().height > 303" a flaw?

Code:

for (i = 0; i < block.numberOfTransactions; i++) {
	
	Transaction transaction = blockTransactions.get(block.transactions[i]);
	
	if (
 		transaction.timestamp > curTime + 15 || 
		transaction.deadline < 1 || 
		(transaction.timestamp + transaction.deadline * 60 < blockTimestamp && 
				getLastBlock().height > 303) 
		|| 
		transaction.fee <= 0 || 
		!transaction.validateAttachment() || Nxt.transactions.get(block.transactions[i]) != null || 
		(transaction.referencedTransaction != 0 && 
		 Nxt.transactions.get(transaction.referencedTransaction) == null && 
		 blockTransactions.get(transaction.referencedTransaction) == null) || 
		(unconfirmedTransactions.get(block.transactions[i]) == null && !transaction.verify())
		) 
	{
		
		break;
		
	}

condition with "303" :  when block height is 1 - 302, transactions' timestamp can be > blockTimestamp.

[opticalcarrier]

Is this "getLastBlock().height > 303" a flaw?

Code:

for (i = 0; i < block.numberOfTransactions; i++) {
	
	Transaction transaction = blockTransactions.get(block.transactions[i]);
	
	if (
 		transaction.timestamp > curTime + 15 || 
		transaction.deadline < 1 || 
		(transaction.timestamp + transaction.deadline * 60 < blockTimestamp && 
				getLastBlock().height > 303) 
		|| 
		transaction.fee <= 0 || 
		!transaction.validateAttachment() || Nxt.transactions.get(block.transactions[i]) != null || 
		(transaction.referencedTransaction != 0 && 
		 Nxt.transactions.get(transaction.referencedTransaction) == null && 
		 blockTransactions.get(transaction.referencedTransaction) == null) || 
		(unconfirmedTransactions.get(block.transactions[i]) == null && !transaction.verify())
		) 
	{
		
		break;
		
	}

condition with "303" :  when block height is 1 - 302, transactions' timestamp can be > blockTimestamp.

hmmm 302 blocks is less than 1 day

[Come-from-Beyond]

Is this "getLastBlock().height > 303" a flaw?

Code:

for (i = 0; i < block.numberOfTransactions; i++) {
	
	Transaction transaction = blockTransactions.get(block.transactions[i]);
	
	if (
 		transaction.timestamp > curTime + 15 || 
		transaction.deadline < 1 || 
		(transaction.timestamp + transaction.deadline * 60 < blockTimestamp && 
				getLastBlock().height > 303) 
		|| 
		transaction.fee <= 0 || 
		!transaction.validateAttachment() || Nxt.transactions.get(block.transactions[i]) != null || 
		(transaction.referencedTransaction != 0 && 
		 Nxt.transactions.get(transaction.referencedTransaction) == null && 
		 blockTransactions.get(transaction.referencedTransaction) == null) || 
		(unconfirmedTransactions.get(block.transactions[i]) == null && !transaction.verify())
		) 
	{
		
		break;
		
	}

condition with "303" :  when block height is 1 - 302, transactions' timestamp can be > blockTimestamp.

It's not the flaw. The block contains a transaction that expired before the block timestamp. The corresponding check was added later.

[jkoil]

Is this "getLastBlock().height > 303" a flaw?

/code]


condition with "303" :  when block height is 1 - 302, transactions' timestamp can be > blockTimestamp.

It's not the flaw. The block contains a transaction that expired before the block timestamp. The corresponding check was added later.

If NXT-copycoin starts from its genesis block, that condition is not causing any problem or risk?

[Come-from-Beyond]

If NXT-copycoin starts from its genesis block, that condition is not causing any problem or risk?

No, don't worry.

[jkoil]

If NXT-copycoin starts from its genesis block, that condition is not causing any problem or risk?

No, don't worry.

ok

*sigh ... the flaw-candidates are running out. Interesting to see the revelation of 3rd of April ...

[Eadeqa]

Could you make this clearer?

Only after 3rd of April.

Don't reveal the flaw on 3rd of April, please

Let someone find it.

[Lohoris]

Don't reveal the flaw on 3rd of April, please

Let someone find it.

Are you seriously suggesting to break a promise?

[Eadeqa]

Don't reveal the flaw on 3rd of April, please

Let someone find it.

Are you seriously suggesting to break a promise?

Where is the promise that the flaw will be revealed on the 3rd? All I see is the promise of reward before that date. 

[etlase3]

Don't reveal the flaw on 3rd of April, please

Let someone find it.

Are you seriously suggesting to break a promise?

Like releasing the full source on Jan 3rd?

[Come-from-Beyond]

Like releasing the full source on Jan 3rd?

It was never promised to release full source on Jan 3rd. Why r u still there, all ur posts r troll posts.

[gimre]

Like releasing the full source on Jan 3rd?

It was never promised to release full source on Jan 3rd. Why r u still there, all ur posts r troll posts.

+1, there was never such promise.

actually I thought source code will be published in April, so it's way ahead of that