this-vishalsingh

// This PoC demonstrates the DoS vulnerability in SXT Node where notification protocols
// are registered without rate limiting parameters (max_notifications_per_peer and rate_limit_allowed_bytes)
// in node/src/service.rs, allowing a malicious peer to flood the network with unlimited messages.

use std::time::{Duration, Instant};
use std::sync::atomic::{AtomicU64, Ordering};
use std::sync::Arc;
use tokio::time::sleep;

this-vishalsingh

Summary

The EVM message processing functionality in the system_tables pallet lacks proper bounds on message count and size, creating a critical DoS vulnerability that can render validators unresponsive for extended periods. This has been confirmed through a functional proof of concept.

Finding Description

When analyzing the codebase in pallets/system_tables/src/lib.rs, I identified that the process_evm_message() function contains a vulnerability where it processes an unbounded number of rows with messages of unlimited size:

pub fn process_evm_message<T: Config>(request: SystemRequest) -> DispatchResult {
    request
        .rows()

this-vishalsingh

// SPDX-License-Identifier: GPL-3.0-or-later
pragma solidity 0.8.26;

import {Test} from "../../lib/forge-std/src/Test.sol";
import {console} from "../../lib/forge-std/src/console.sol";
import {AlchemistV3} from "../AlchemistV3.sol";
import {IERC20} from "../../lib/openzeppelin-contracts/contracts/token/ERC20/IERC20.sol";
import {SafeERC20} from "../libraries/SafeERC20.sol";