Description
What is wrong?
Several block operation validation functions can raise IndexError in addition to a ValidationError e.g. validate_voluntary_exit(), validate_proposer_slashing() when passed an Operation with an invalid validator index.
It is not obvious whether this is a documentation issue (that IndexErrors are an expected result), or a crash-causing bug and DOS vector:
- Test handlers have
IndexErroras an expected exception type: https://github.com/ethereum/trinity/blob/84381f4fe19b18dddf2d2b210bd0780038728acd/eth2/beacon/tools/fixtures/test_types/operations.py#L135-L146 - Block importing doesn't appear to handle
IndexErrors: https://github.com/ethereum/trinity/blob/84381f4fe19b18dddf2d2b210bd0780038728acd/trinity/sync/beacon/chain.py#L158
How can it be fixed
Catch IndexErrors immediately and wrap them with a ValidationError. This is clearer and avoids potential bugs from forgetting to catch IndexErrors.
How it was found
Discovered via beacon-fuzz (initial testing of proposer_slashing fuzzer).
Triggering case: proposer_slashing-crash-35a9d8e810ef1c20f057ee4e6aa8a927dc2ed6dc with the following beacon_states
Or the pre-processed input propslash_preprocessed_indexerror.ssz can be directly passed to the trinity harness