Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump version to 0.34.0 and finilized the CHANGELOG.md #488

Merged
merged 3 commits into from
Jun 13, 2023
Merged

Conversation

xgreenx
Copy link
Collaborator

@xgreenx xgreenx commented Jun 13, 2023

Release v0.34.0

This release contains fixes for critical issues that we found before the audit. Mainly, these changes pertain to the Sparse Merkle Tree (SMT) and related code. The SMT API was extended to provide more flexibility and to allow users to select the most appropriate method their performance needs. Where possible, sequential SMT updates were replaced with constructors that take in a complete data set.

Added

  • #476: The fuel_vm::Call supports From<[u8; Self::LEN]> and Into<[u8; Self::LEN]>.

  • #484: The sparse::in_memory::MerkleTree got new methods from_set, root_from_set, and nodes_from_set methods. These methods allow a more optimal way to build and calculate the SMT when you know all leaves. The Contract::initial_state_root is much faster now (by ~15 times).

Removed

  • #478: The CheckedMemRange is replaced by the MemoryRange.

Changed

  • #477: The PanicReason::UnknownPanicReason is 0x00. The PanicReason now implements From<u8> instead of TryFrom<u8> and can't return an error anymore.

  • #478: The memcopy method is updated and returns MemoryWriteOverlap instead of MemoryOverflow.

Fixed

  • #482: This PR address a security issue where updates to a Sparse Merkle Tree could deliberately overwrite existing leaves by setting the leaf key to the hash of an existing leaf or node. This is done by removing the insertion of the leaf using the leaf key.

  • #484: Fixed bug with not-working CreateMetadata.

Breaking

  • #473: CFS and CFSI were not validating
    that the new $sp value isn't below $ssp, allowing write access to non-owned
    memory. This is now fixed, and attempting to set an incorrect $sp value panics.

  • #485: This PR addresses a security
    issue where the user may manipulate the structure of the Sparse Merkle Tree.
    SMT expects hashed storage key wrapped into a MerkleTreeKey structure.
    The change is breaking because it changes the state_root generated by the SMT
    and may change the ContractId if the Create transaction has non-empty StoargeSlots.

All changes:

@xgreenx xgreenx requested a review from a team June 13, 2023 00:16
@xgreenx xgreenx self-assigned this Jun 13, 2023
CHANGELOG.md Outdated Show resolved Hide resolved
Co-authored-by: Brandon Vrooman <brandon.vrooman@fuel.sh>
@xgreenx xgreenx requested review from bvrooman and a team June 13, 2023 01:46
@Voxelot Voxelot added this pull request to the merge queue Jun 13, 2023
Merged via the queue into master with commit e96d51d Jun 13, 2023
@Voxelot Voxelot deleted the release/0.34.0 branch June 13, 2023 02:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants