@aztec-labs/stdlib 6.0.0-rc.1 → 6.0.0-rc.2

package/src/p2p/block_proposal.ts

@@ -281,6 +281,12 @@ export class BlockProposal extends Gossipable implements Signable {
   static fromBuffer(buf: Buffer | BufferReader): BlockProposal {
     const reader = BufferReader.asReader(buf);
 
+    // Decoding is lenient on purpose, for forward compatibility: trailing bytes are ignored and any non-zero
+    // presence flag reads as present, so a newer version can append fields that older nodes skip over. Rejecting
+    // them would make every wire extension a coordinated upgrade. Lenient decoding does not let one proposal take
+    // several identities, since the P2P message identifier and the signature both cover the signed payload rather
+    // than the raw bytes.
+
     const blockHeader = reader.readObject(BlockHeader);
     const indexWithinCheckpoint = IndexWithinCheckpoint(reader.readNumber());
     const archiveRoot = reader.readObject(Fr);

package/src/p2p/checkpoint_proposal.ts

@@ -308,6 +308,12 @@ export class CheckpointProposal extends Gossipable implements Signable {
   static fromBuffer(buf: Buffer | BufferReader): CheckpointProposal {
     const reader = BufferReader.asReader(buf);
 
+    // Decoding is lenient on purpose, for forward compatibility: trailing bytes are ignored and any non-zero
+    // presence flag reads as present, so a newer version can append fields that older nodes skip over. Rejecting
+    // them would make every wire extension a coordinated upgrade. Lenient decoding does not let one proposal take
+    // several identities, since the P2P message identifier and the signature both cover the signed payload rather
+    // than the raw bytes.
+
     const checkpointHeader = reader.readObject(CheckpointHeader);
     const archive = reader.readObject(Fr);
     const feeAssetPriceModifier = reader.readInt256();

package/src/p2p/gossipable.ts

@@ -26,6 +26,12 @@ export class P2PMessage {
       traceContext = reader.readString();
     }
     const payload = reader.readBuffer();
+    // Reject trailing bytes: padding leaves the same payload but a new message id, so a copy evades
+    // both the seen-message dedup and the duplicate-delivery peer scoring, letting a peer replay one
+    // valid message (e.g. a proposal it cannot forge) as fresh deliveries.
+    if (!reader.isEmpty()) {
+      throw new Error('P2PMessage has trailing bytes after its payload');
+    }
     return new P2PMessage(payload, timestamp, traceContext);
   }