QA-13: Unconditional Timer Reset on Unknown Seqnum in complete_polled_requests

Summary

complete_polled_requests resets the preload timer before confirming that the provided sequence number exists in the preload map.

Vulnerability details

1
pub fn complete_polled_requests(
2
    &mut self,
3
    predicted_proposal_seqnum: SeqNum,
4
    requests: impl Iterator<Item = Address>,
5
) {
6
    self.timer.set(tokio::time::sleep(Duration::from_millis(
7
        PRELOAD_INTERVAL_MS,
8
    )));
9

10
    let Entry::Occupied(mut entry) = self.map.entry(predicted_proposal_seqnum) else {
11
        warn!(?predicted_proposal_seqnum, "unknown seqnum");
12
        return;
13
    };

Impact

An attacker who can repeatedly trigger completions for unknown sequence numbers can keep pacing the timer and delay future preload batches.

Recommendation

Only reset the timer after the sequence number is validated and the map entry is known to exist.