Skip to content

Instantly share code, notes, and snippets.

# This file is automatically @generated by Cargo.
# It is not intended for manual editing.
version = 4
[[package]]
name = "autocfg"
version = "1.5.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"

Obyte ocore AA Address Case Divergence PoC

Summary

This PoC demonstrates a deterministic consensus validation divergence between official SQLite-backed and MySQL-backed ocore database schemas.

The vulnerable path is validation.js::validateAATrigger(). Payment outputs allow any-case addresses through isValidAddressAnyCase(), but MySQL stores aa_addresses.address and outputs.address under case-insensitive utf8mb4_unicode_520_ci collation while SQLite uses bytewise/default comparison.

As a result, a payment output to lowercase(AA_ADDRESS) can match the canonical uppercase AA address on MySQL, but not on SQLite. If the same signed unit also includes max_aa_responses=1, SQLite rejects it as having no AA output while MySQL accepts it.