zeekay 3f95d00a49 pulsar: fix mlen uint64 overflow → chain-halt (CRITICAL launch blocker) ...

verify parsed mlen from attacker's low-8-bytes, then guarded with
len(body) < mlen+sigSize — which OVERFLOWS uint64 when mlen is near MaxUint64,
slipping past the guard so body[:mlen] panics. A panic in geth's precompile
dispatch has no recover() → every validator halts on the tx. Fixed with a
non-overflowing subtraction guard (mlen > len(body) || len(body)-mlen < sigSize).
Regression test TestVerify_MlenOverflowRejected proves reject-not-panic.
Red-team finding #5.

2026-06-27 18:35:29 -07:00

..

contract_test.go

precompile: decomplect strict-PQ gate across every classical Run() (#2)

2026-05-11 15:10:04 -07:00

contract.go

pulsar: fix mlen uint64 overflow → chain-halt (CRITICAL launch blocker)

2026-06-27 18:35:29 -07:00

module.go

CRIT: register Pulsar (0x012204) + P3Q (0x012205) precompile modules

2026-05-13 15:05:45 -07:00

overflow_test.go

pulsar: fix mlen uint64 overflow → chain-halt (CRITICAL launch blocker)

2026-06-27 18:35:29 -07:00