fix(zetaclient): infinite discovery address leak #3171
Conversation
gartnera
added
no-changelog
gartnera
requested review from
brewmaster012,
kingpinXD,
lumtis,
ws4charlie,
skosito,
swift1337 and
fbac
as code owners
📝 WalkthroughWalkthroughThe Changes
Possibly related PRs
Suggested labels
Suggested reviewers
Warning Rate limit exceeded@gartnera has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 4 minutes and 58 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📜 Recent review detailsConfiguration used: .coderabbit.yaml ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
🔇 Additional comments (2)go.mod (2)
The removal of indirect comments from Also applies to: 298-298
The replacement of Let's verify the TSS library usage and potential impact: ✅ Verification successfulLet me gather more information about the changes in the forked TSS library to understand the impact better. TSS Library Update Addresses Critical Discovery Address Leak The replacement of the TSS library with the forked version is verified to be a targeted security fix. The commit message from the forked repository explicitly confirms that it addresses the infinite discovery address leak issue. The change impacts multiple components across the codebase, but the modification is contained to the library replacement without requiring additional code changes. Key findings:
🏁 Scripts executedThe following scripts were executed for the analysis: Script: #!/bin/bash
# Search for TSS library imports and usage
echo "Checking TSS library imports..."
rg -l "gitlab.com/thorchain/tss/go-tss"
echo "Checking TSS discovery-related function calls..."
ast-grep --pattern 'discovery.$_($$$)'
echo "Checking for any remaining thorchain TSS references..."
rg "thorchain.*tss"
Length of output: 2110 Script: #!/bin/bash
# Check the commit history of the forked TSS library
echo "Checking the forked TSS library commit..."
gh api repos/zeta-chain/go-tss/commits/8535262eb16f --jq '.commit.message'
# Look for discovery-related code patterns
echo "Checking discovery patterns in the codebase..."
rg -A 3 "discovery" --type go
# Check for any TSS configuration or setup code
echo "Looking for TSS configuration..."
ast-grep --pattern 'NewTssServer($$$)'
ast-grep --pattern 'NewTssKeySign($$$)'
Length of output: 562 Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
* fix(zetaclient): infinite discovery address leak (#3171) * changelog
zeta-chain/go-tss#37
Will backport to release/v22 and release v22.1.1
No changelog since it will be released on v22
Summary by CodeRabbit