-
Notifications
You must be signed in to change notification settings - Fork 51
Closed as not planned
Closed as not planned
Copy link
Labels
Audit: Contract Reviews 👀Internal reviewInternal reviewCompatibility: ABI change 🗯Smart contract ABI is changing.Smart contract ABI is changing.Package: ContractsCourt smart contractsCourt smart contractsType: Bug 🐛
Description
Problem
The externalDisputeID is local to a particular arbitrable and is emitted by the Arbitrable.DisputeRequest event.
Later when a court user calls submitEvidence() they reference this externalDisputeID as part of Evidence event, but it does not specify the arbitrable relevant to this externalDisputeID.
EvidenceModule.submitEvidence() then this adjacent issue is relevant #2160
Solution
Add an _arbitrable parameter to IEvidence.submitEvidence() and the Evidence event.
Security Considerations
A malicious user may spoof the value of _arbitrable when submitting evidence. As long as this information is used only for the purpose of displaying evidence, it falls into 3 cases:
_arbitrableis the correct value, no problem._arbitrableis another arbitrable where the_externalDisputeIDexists, then the evidence is displayed for that other incorrect dispute.
-> If an attacker wants to achieve this, they can already do it today, so it does not increase the attack surface._arbitrableis something else, then_externalDisputeIDwon't match anything and the evidence won't be displayed.
Metadata
Metadata
Assignees
Labels
Audit: Contract Reviews 👀Internal reviewInternal reviewCompatibility: ABI change 🗯Smart contract ABI is changing.Smart contract ABI is changing.Package: ContractsCourt smart contractsCourt smart contractsType: Bug 🐛