node-data: add ConsensusHeader to Candidate signature

Without a signature on the ConsensusHeader, Candidate messages would be malleable. Adding the structure to the signable data fix the issue.
dusk-network · Aug 27, 2024 · b4b2f9b · b4b2f9b
1 parent 76698f2
commit b4b2f9b
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/node-data/src/message.rs b/node-data/src/message.rs
@@ -1242,7 +1242,10 @@ impl StepMessage for Candidate {
         &mut self.sign_info
     }
     fn signable(&self) -> Vec<u8> {
-        self.candidate.header().hash.to_vec()
+        let mut signable = self.header.signable();
+        let candidate_hash = self.candidate.header().hash.to_vec();
+        signable.extend_from_slice(&candidate_hash);
+        signable
     }
     fn header(&self) -> &ConsensusHeader {
         &self.header