QA-05: Positional Trailing Fields Can Be Misparsed in ConsensusBlockHeader

monad-qa-05-positional-trailing-fields

Summary

Optional fields such as base_fee, base_fee_trend, and base_fee_moment are decoded based on remaining payload length instead of explicit presence flags.

Vulnerability details

1
let mut this = Self {
2
    block_round: Decodable::decode(buf)?,
3
    epoch: Decodable::decode(buf)?,
4
    qc: Decodable::decode(buf)?,
5
    author: Decodable::decode(buf)?,
6
    seq_num: Decodable::decode(buf)?,
7
    timestamp_ns: Decodable::decode(buf)?,
8
    round_signature: Decodable::decode(buf)?,
9
    delayed_execution_results: Decodable::decode(buf)?,
10
    execution_inputs: Decodable::decode(buf)?,
11
    block_body_id: Decodable::decode(buf)?,
12
    base_fee: None,
13
    base_fee_trend: None,
14
    base_fee_moment: None,
15
};
16

17
if starting_len - buf.len() < rlp_header.payload_length {
18
    this.base_fee = Some(Decodable::decode(buf)?);
19
}
20

21
if starting_len - buf.len() < rlp_header.payload_length {
22
    this.base_fee_trend = Some(Decodable::decode(buf)?);
23
}

Impact

If field coupling changes in the future, a trailing value intended for one optional field can be misinterpreted as another during decoding.

Recommendation

Use explicit presence markers or a structure that encodes field presence unambiguously.