Upgrade-15 Security Bulletin
This bulletin highlights security improvements in the recent Agoric upgrade, agoric-upgrade-15.
RPC stability improvements
#9276: Event history contains duplicate objects
- This fix addresses a logic bug introduced in upgrade-14 that affected RPC stability.
- A logic flaw in handling simulated transactions caused RPC servers to update application state. Application state is never supposed to be updated during simulation. The flaw caused some RPC nodes to halt due to apphash errors.
- This was treated as a security fix, anticipating that an attacker may use similar issues to impact the availability of RPC nodes. Availability is a security-critical aspect of blockchains.
Smart wallet invitation handling
#9239: enhance smart wallet behavior when invitation creation fails
- This fix addresses a logic bug introduced in upgrade-14 that delayed users’s abilities to reclaim payments after failed transactions.
- A single transaction was impacted by this issue. The impacted assets were fully recoverable and have since been reclaimed.
- This was treated as a security fix, anticipating future conditions where this or similar issues could allow malicious actors to impede payout liveness, a crucial guarantee.
—–
For a complete list of changes that include non-security fixes, see the agoric-upgrade-15 release notes.
If you need to contact the Agoric security team, please don’t hesitate to email us at security@agoric.com. Please note that we offer a bug bounty and reward vulnerabilities reported to us via HackerOne.