Hare broker buffer for early messages is unlimited

[gavraz]

The buffer for early messages is limited. Upon reaching the buffer limit, the consensus process associated with this buffer is canceled and the messages are dropped. The vulnerability is that malicious nodes can make honest node not participate in the Hare protocol.

[jonZlotnik]

Related code block:

https://github.com/spacemeshos/go-spacemesh/blob/0cb3732b0796ed442366f39ef8cf3909a0c2b48d/hare/broker.go#L280-L302

[jonZlotnik]

If we can answer this question (https://github.com/spacemeshos/pm/issues/178) with a "no". Then we can simply cap the buffers to slightly more than the expected committee sizes and drop/replace messages from the same sender. The broker already drops messages that don't validate with the oracle.