Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Observation] Sanitization of Inputs Rely on External Crates #10

Open
flyingnobita opened this issue Feb 26, 2024 · 0 comments
Open

[Observation] Sanitization of Inputs Rely on External Crates #10

flyingnobita opened this issue Feb 26, 2024 · 0 comments

Comments

@flyingnobita
Copy link
Collaborator

flyingnobita commented Feb 26, 2024

Describe the observation

There are currently 2 main ways for the entry balances to enter the circuit:

  1. CSV (which are then feed into MstInclusionCircuit)
  2. directly to MstInclusionCircuit

When balances are fed from the CSV, they are converted from str to big_uint by BigUint::parse_bytes() from num-bitint=0.4.

If the user put in entry balances directly in the circuit, it is converted from big_uint to Fp with Fp::from_str_vartime() in the big_uint_to_fp() function. This uses the halo2_proofs::halo2curves::{bn256::Fr as Fp} crate.

More work has been done on this PR by @sebastiantf.

Additional context

Simple sanitization tests with inputs of negative numbers and strings with alphabet characters have been done and they were successfully caught by the above mentioned crates. However, the sanitization robustness of the 2 crates have not been investigated or thoroughly tested. Furthermore, they could be subject to change in future versions. This can have material impact on Summa should these crates be upgraded without proper sanitization testing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant