QA-09: ConsensusMessage Late Version Validation Allows Resource Exhaustion

Summary

ConsensusMessage uses derived RLP decoding, which means nested protocol payloads are decoded before the version field is rejected.

Vulnerability details

1
#[derive(Clone, Debug, PartialEq, Eq, RlpEncodable, RlpDecodable)]
2
pub struct ConsensusMessage<ST, SCT, EPT>
3
where
4
    ST: CertificateSignatureRecoverable,
5
    SCT: SignatureCollection<NodeIdPubKey = CertificateSignaturePubKey<ST>>,
6
    EPT: ExecutionProtocol,
7
{
8
    pub version: u32,
9
    pub message: ProtocolMessage<ST, SCT, EPT>,
10
}

1
if msg_version != client_version {
2
    return Err(Error::InvalidVersion);
3
}

Impact

A peer can send oversized wrong-version messages that still trigger heavy nested decoding work before the node returns InvalidVersion.

Recommendation

Implement a manual decoder that validates the version first and decodes the expensive payload only after that check passes.