QA-03: BlockSync Processes Invalid Peer Data Without Penalty

monad-qa-03-invalid-peer-data-without-penalty

Summary

BlockSync performs expensive validation on headers and payloads received from peers, but it does not score, quarantine, or deprioritize peers that repeatedly send invalid data.

Details

Unexpected or malicious responses still trigger verification work. When validation fails, the node increments metrics and retries with another peer, but the offender remains fully eligible for future selection.

1
if Self::verify_block_headers(block_range, block_headers.as_slice()) {
2
    entry.remove();
3
    self.metrics.blocksync_events.headers_response_successful += 1;
4
} else {
5
    debug!(?sender, ?block_range, "blocksync: headers response verifcation failed");
6
    assert!(sender.is_some());
7
    self.metrics.blocksync_events.headers_validation_failed += 1;
8
    // headers response from peer is invalid, re-request after timeout
9
}

1
fn pick_peer(
2
    self_node_id: &NodeId<CertificateSignaturePubKey<ST>>,
3
    current_epoch: Epoch,
4
    val_epoch_map: &ValidatorsEpochMapping<VTF, SCT>,
5
    override_peers: &[NodeId<CertificateSignaturePubKey<ST>>],
6
    rng: &mut ChaCha8Rng,
7
) -> NodeId<CertificateSignaturePubKey<ST>> {

Impact

An attacker can repeatedly feed invalid responses and force CPU and bandwidth expenditure while remaining in the candidate set for retries.

Recommendation

Introduce lightweight peer scoring with temporary penalties for invalid responses.