mirror of
https://github.com/luxfi/corona.git
synced 2026-09-24 00:25:54 +00:00
zeekay
5f91c2c15a
One round-1 message killed an honest validator. MatrixAdd answered a shape
mismatch with log.Fatalf — os.Exit, no error, no recoverable panic — and
SignRound2Preprocess folded every entry of the peer-supplied D map through it
while the MAC loop authenticated only the agreed set T. A commitment carrying a
party id outside T was never checked and still reached the adder, so a
Round1Data{PartyID: 7, D: nil} from a non-member exited the process.
Three changes, one rule: nothing that touches peer data may take the process
down, and membership is the authentication precondition. MatrixAdd returns an
error the caller refuses on. The preprocess fold ranges T rather than the whole
map, so only authenticated commitments reach a kernel. And Round2 refuses a
round-1 message from a party outside the signing set at the boundary, before its
matrix touches anything — which is where the membership check belonged, since the
MACs downstream only cover members.
Upstream never terminates on a peer message; neither does this now.