(HAL-25) SEQUENCE NUMBER MISMATCH IN TRANSACTION PROCESSING

[SA124]

(HAL-25) SEQUENCE NUMBER MISMATCH IN TRANSACTION PROCESSING
Auditor: Halborn
Severity: Informational

Description
In the opt-executor transaction processing implementation in tick_transaction_pipe, there is a discrepancy between the sequence number used for transaction validation and the one used for adding the transaction to the mempool.

This mismatch bypasses an essential verification ensuring that user cannot use sequences that they already used. Fortunately, the execution VM performs the same verification upstream, but that could have an impact on future upgrades.

Score
AO:A/AC:L/AX:L/R:N/S:U/C:N/A:N/I:N/D:N/Y:N (0.0)

Recommendation
It is recommended to use the sequence number from the database instead of the one from the transaction.

[mzabaluev]

Duplicate of #415

[l-monninger]

This has been dealt with or modified in several forms. The latest change to sequence number validation to prevent GAS DOS was included in #722.