From 6a7d221f72e34974684bb17f228f5884e9476ed5 Mon Sep 17 00:00:00 2001 From: realbigsean Date: Mon, 16 Nov 2020 02:59:35 +0000 Subject: [PATCH] add slot validation to attestation_data endpoint (#1888) ## Issue Addressed Resolves #1801 ## Proposed Changes Verify queries to `attestation_data` are for no later than `current_slot + 1`. If they are later than this, return a 400. Co-authored-by: realbigsean --- beacon_node/http_api/src/lib.rs | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/beacon_node/http_api/src/lib.rs b/beacon_node/http_api/src/lib.rs index 61c4347530..ff8d34fdfd 100644 --- a/beacon_node/http_api/src/lib.rs +++ b/beacon_node/http_api/src/lib.rs @@ -1582,6 +1582,18 @@ pub fn serve( .and_then( |query: api_types::ValidatorAttestationDataQuery, chain: Arc>| { blocking_json_task(move || { + let current_slot = chain + .slot() + .map_err(warp_utils::reject::beacon_chain_error)?; + + // allow a tolerance of one slot to account for clock skew + if query.slot > current_slot + 1 { + return Err(warp_utils::reject::custom_bad_request(format!( + "request slot {} is more than one slot past the current slot {}", + query.slot, current_slot + ))); + } + chain .produce_unaggregated_attestation(query.slot, query.committee_index) .map(|attestation| attestation.data)