Component
Other
Priority
P2
What happened?
The registration retry cache (~/.dotns/registrations/<env>__<addr>__<label>.json) protects only the commit secret. owner, maxPrice, reserved and transferDestination are plaintext with no integrity check, and register retry replays them as-is. transferDestination in particular is executed after mint: the freshly registered name is auto-transferred to whatever address the file says.
Reproduced with 0.9.0: interrupted a registration after the commit, edited transferDestination in the cache file to a foreign address, ran register retry — it loaded the tampered record without complaint, decrypted the secret, and proceeded toward mint-then-transfer (aborted before the reveal tx). register list shows no tamper warning either.
Precondition is local write access to the cache dir (mode 700/600 helps), so this needs a compromised or shared machine — but the outcome is losing the name to the attacker while signing with your own key.
Expected behavior
Bind the whole record (or at least owner/transferDestination/maxPrice) into the AEAD instead of only the secret, and refuse records that fail authentication. owner is already protected indirectly by the commitment hash; the transfer destination is not.
Component
Other
Priority
P2
What happened?
The registration retry cache (
~/.dotns/registrations/<env>__<addr>__<label>.json) protects only the commit secret.owner,maxPrice,reservedandtransferDestinationare plaintext with no integrity check, andregister retryreplays them as-is.transferDestinationin particular is executed after mint: the freshly registered name is auto-transferred to whatever address the file says.Reproduced with 0.9.0: interrupted a registration after the commit, edited
transferDestinationin the cache file to a foreign address, ranregister retry— it loaded the tampered record without complaint, decrypted the secret, and proceeded toward mint-then-transfer (aborted before the reveal tx).register listshows no tamper warning either.Precondition is local write access to the cache dir (mode 700/600 helps), so this needs a compromised or shared machine — but the outcome is losing the name to the attacker while signing with your own key.
Expected behavior
Bind the whole record (or at least
owner/transferDestination/maxPrice) into the AEAD instead of only the secret, and refuse records that fail authentication.owneris already protected indirectly by the commitment hash; the transfer destination is not.