lotus icon indicating copy to clipboard operation
lotus copied to clipboard

Events: TOCTOU Race when subscribing to new events

Open Stebalien opened this issue 8 months ago • 1 comments

We:

  1. Lock, get the latest processed height, unlock.
  2. Apply a "pre" filter to query for already processed events.
  3. Lock, install the new filter, unlock.

But blocks can come in between step 2 and step 3. We need to do one of:

  1. Hold the lock the entire time (probably not viable).
  2. Re-try if the height changes between when we release the lock and when we retake it. Or, really, req-query for the new tipsets (taking reverts into account, unfortunately...).
  3. Install the filter first (buffering events instead of emitting them), recording the current height, then prefill up to that height, then start processing the buffered events. Need to be careful here to avoid DoS vectors.

Stebalien avatar Jun 18 '24 22:06 Stebalien