Skip to content

fix: cache slot in check_block_relevancy to prevent TOCTOU#8776

Open
radik878 wants to merge 4 commits intosigp:unstablefrom
radik878:fix/check-block-relevancy-slot-toctou
Open

fix: cache slot in check_block_relevancy to prevent TOCTOU#8776
radik878 wants to merge 4 commits intosigp:unstablefrom
radik878:fix/check-block-relevancy-slot-toctou

Conversation

@radik878
Copy link

@radik878 radik878 commented Feb 9, 2026

Why

check_block_relevancy called chain.slot()? twice — once for the comparison and once inside the FutureSlot error. Since chain.slot()

pub fn slot(&self) -> Slot {
self.block.slot()
}
reads the current time from the slot clock, the slot can advance between the two calls at a slot boundary. This causes present_slot in the error to be higher than block_slot, which is logically contradictory for a "future slot" error and can mislead logging and peer scoring.

Every other FutureSlot check in the codebase (gossip blocks, blobs, data columns, attestations, sync committees) already caches the slot in a local variable. This was the only place that didn't.

What

Store chain.slot()? in a local variable and reuse it for both the comparison and the error construction, consistent with the rest of
the codebase.

hopinheimer and others added 4 commits February 4, 2026 01:40
Co-Authored-By: hopinheimer <knmanas6@gmail.com>

Co-Authored-By: hopinheimer <48147533+hopinheimer@users.noreply.github.com>

Co-Authored-By: Eitan Seri-Levi <eserilev@ucsc.edu>

Co-Authored-By: Michael Sproul <michael@sigmaprime.io>

Co-Authored-By: Michael Sproul <michaelsproul@users.noreply.github.com>
Closes sigp#8681


  


Co-Authored-By: Jimmy Chen <jchen.tc@gmail.com>
@cla-assistant
Copy link

cla-assistant bot commented Feb 9, 2026

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

1 similar comment
@cla-assistant
Copy link

cla-assistant bot commented Feb 9, 2026

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@michaelsproul
Copy link
Member

#Sounds reasonable, can you please rebase on unstable?

@michaelsproul michaelsproul changed the base branch from stable to unstable February 9, 2026 20:46
@michaelsproul
Copy link
Member

I've changed the base branch on github but you will need to push a rebased commit for CI to pass.

Please also sign the CLA

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants