How CertiK Found Five Vulnerabilities in Besu and Got Them Fixed in a Fortnight
Denial of service is the least fashionable category in security because nothing is stolen and nothing is forged and the report at the end of it reads like a capacity planning memo rather than a crime scene. On most infrastructure that reputation is deserved, since a process that exhausts its heap will trip a pager and somebody will restart it and the week will carry on roughly as it would have done anyway. Consensus networks are the exception to this comfortable arrangement, because a node that has stopped answering has not merely stopped serving traffic but has stopped voting, while Ethereum's finality rules are interested in votes rather than in intentions. A validator caught in a garbage collection spiral looks identical, from the network's side of the connection, to a validator that somebody unplugged. Availability on these systems is not a reliability concern sitting politely alongside the security model but...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
