Merge branch 'develop' of https://github.com/stacks-network/stacks-core into bugfix/signers-send-updates-after-timing-out-block

Author: jacinta-stacks

CHANGELOG.md

@@ -11,23 +11,28 @@ and this project adheres to the versioning scheme outlined in the [README.md](RE
 
 - Setup for epoch 3.4 and Clarity version 5. Epoch 3.4 is currently set to activate at Bitcoin height 3,400,000 (very far in the future) until an activation height is selected. Clarity will activate with epoch 3.4.
 
+## [3.3.0.0.5]
+
+### Added
+
+- New endpoint `/v3/blocks/simulate/{block_id}` allows to simulate the execution of a specific block with a brand new set of transactions
+- Improved block validation in `stacks-inspect`.
+
+### Changed
+
+- Removed `validate-naka-block` option in `stacks-inspect`, merging it with `validate-block` so that users do not need to differentiate between the two.
+
 ## [3.3.0.0.4]
 
 ### Added
 
 - New `/v3/tenures/tip_metadata` endpoint for returning some metadata along with the normal tenure tip information.
-- New endpoint `/v3/blocks/simulate/{block_id}` allows to simulate the execution of a specific block with a brand new set of transactions
 
 ## [3.3.0.0.3]
 
 ### Added
 
 - In the `/v3/transaction/{txid}` RPC endpoint, added `block_height` and `is_canonical` to the response.
-- Improved block validation in `stacks-inspect`.
-
-### Changed
-
-- Removed `validate-naka-block` option in `stacks-inspect`, merging it with `validate-block` so that users do not need to differentiate between the two.
 
 ### Fixed
 

clarity/src/vm/functions/post_conditions.rs

@@ -477,7 +477,8 @@ fn check_allowances(
     }
 
     // Check STX movements
-    if let Some(stx_moved) = assets.get_stx(owner) {
+    let amount_moved = assets.get_stx(owner);
+    if let Some(stx_moved) = amount_moved {
         if stx_allowances.is_empty() {
             // If there are no allowances for STX, any movement is a violation
             record_violation(MAX_ALLOWANCES as u128);
@@ -492,7 +493,8 @@ fn check_allowances(
     }
 
     // Check STX burns
-    if let Some(stx_burned) = assets.get_stx_burned(owner) {
+    let amount_burned = assets.get_stx_burned(owner);
+    if let Some(stx_burned) = amount_burned {
         if stx_allowances.is_empty() {
             // If there are no allowances for STX, any burn is a violation
             record_violation(MAX_ALLOWANCES as u128);
@@ -581,6 +583,26 @@ fn check_allowances(
         }
     }
 
+    if earliest_violation.is_none() {
+        // Check combined STX burns and movements. If the total exceeds any allowance,
+        // emit an error that makes this transaction invalid.
+        let total_stx_change = amount_moved
+            .unwrap_or(0)
+            .checked_add(amount_burned.unwrap_or(0))
+            .ok_or(VmInternalError::Expect(
+                "STX movement and burn overflowed u128".into(),
+            ))?;
+        if total_stx_change > 0 {
+            for (_, allowance) in &stx_allowances {
+                if total_stx_change > *allowance {
+                    return Err(VmExecutionError::Internal(VmInternalError::Expect(
+                        "Total STX movement and burn exceeds allowance".into(),
+                    )));
+                }
+            }
+        }
+    }
+
     Ok(earliest_violation)
 }
 

stacks-node/src/tests/nakamoto_integrations.rs

@@ -79,7 +79,7 @@ use stacks::core::{
     PEER_VERSION_EPOCH_1_0, PEER_VERSION_EPOCH_2_0, PEER_VERSION_EPOCH_2_05,
     PEER_VERSION_EPOCH_2_1, PEER_VERSION_EPOCH_2_2, PEER_VERSION_EPOCH_2_3, PEER_VERSION_EPOCH_2_4,
     PEER_VERSION_EPOCH_2_5, PEER_VERSION_EPOCH_3_0, PEER_VERSION_EPOCH_3_1, PEER_VERSION_EPOCH_3_2,
-    PEER_VERSION_TESTNET,
+    PEER_VERSION_EPOCH_3_3, PEER_VERSION_TESTNET,
 };
 use stacks::libstackerdb::{SlotMetadata, StackerDBChunkData};
 use stacks::net::api::callreadonly::CallReadOnlyRequestBody;
@@ -237,7 +237,7 @@ lazy_static! {
             start_height: 253,
             end_height: STACKS_EPOCH_MAX,
             block_limit: HELIUM_BLOCK_LIMIT_20,
-            network_epoch: PEER_VERSION_EPOCH_3_2
+            network_epoch: PEER_VERSION_EPOCH_3_3
         },
     ];
 }

stacks-signer/CHANGELOG.md

@@ -5,9 +5,10 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to the versioning scheme outlined in the [README.md](README.md).
 
-
 ## [Unreleased]
 
+## [3.3.0.0.5.0]
+
 ### Changed
 
 - Reduced default tenure-extend idle timer from 120 seconds to 60 seconds

stackslib/src/chainstate/nakamoto/mod.rs

@@ -4636,6 +4636,15 @@ impl NakamotoChainState {
             ));
         }
 
+        if parent_chain_tip.stacks_block_height.saturating_add(1) != block.header.chain_length {
+            warn!("Error processing nakamoto block: Parent height does not agree with block chain length";
+                  "parent_chain_tip.block_height" => %parent_chain_tip.stacks_block_height,
+                  "block.header.chain_length" => &block.header.chain_length);
+            return Err(ChainstateError::InvalidStacksBlock(
+                "Parent block height does not agree with child block".into(),
+            ));
+        }
+
         // look up this block's sortition's burnchain block hash and height.
         // It must exist in the same Bitcoin fork as our `burn_dbconn`.
         let tenure_block_snapshot =

stackslib/src/net/api/postblock_proposal.rs

@@ -546,6 +546,21 @@ impl NakamotoBlockProposal {
             });
         }
 
+        if self.block.header.chain_length
+            != parent_stacks_header.stacks_block_height.saturating_add(1)
+        {
+            warn!(
+                "Rejected block proposal";
+                "reason" => "Block height is non-contiguous with parent",
+                "block_height" => self.block.header.chain_length,
+                "parent_block_height" => parent_stacks_header.stacks_block_height,
+            );
+            return Err(BlockValidateRejectReason {
+                reason_code: ValidateRejectCode::InvalidBlock,
+                reason: "Block height is non-contiguous with parent".into(),
+            });
+        }
+
         let tenure_change = self
             .block
             .txs

stackslib/src/util_lib/bloom.rs

@@ -23,7 +23,9 @@ use rand::thread_rng;
 use rusqlite::blob::Blob;
 use rusqlite::{params, Error as sqlite_error};
 use siphasher::sip::SipHasher; // this is SipHash-2-4
-use stacks_common::codec::{read_next, write_next, Error as codec_error, StacksMessageCodec};
+use stacks_common::codec::{
+    read_next, write_next, Error as codec_error, StacksMessageCodec, MAX_MESSAGE_LEN,
+};
 use stacks_common::types::sqlite::NO_PARAMS;
 use stacks_common::util::hash::{to_hex, Sha512Trunc256Sum};
 
@@ -112,6 +114,9 @@ fn decode_bitfield<R: Read>(fd: &mut R) -> Result<Vec<u8>, codec_error> {
         x if x == BitFieldEncoding::Sparse as u8 => {
             // sparse encoding
             let vec_len: u32 = read_next(fd)?;
+            if vec_len > MAX_MESSAGE_LEN.saturating_sub(5) {
+                return Err(codec_error::OverflowError("vec_len is too big".into()));
+            }
             let num_filled: u32 = read_next(fd)?;
 
             let mut ret = vec![0u8; vec_len as usize];
@@ -929,6 +934,17 @@ pub mod test {
                 0x00, 0x00, 0x0f, 0x08
             ]
         );
+
+        // vec_len too big
+        let mut bitfield_too_big = vec![];
+        encode_bitfield(&mut bitfield_too_big, &vec![0u8; MAX_MESSAGE_LEN as usize]).unwrap();
+        let e = decode_bitfield(&mut &bitfield_too_big[..]);
+        if let Err(codec_error::OverflowError(s)) = e {
+            assert_eq!(s, "vec_len is too big".to_string());
+        } else {
+            error!("Unexpected decode_bitfield result: {e:?}");
+            panic!();
+        }
     }
 
     #[test]

versions.toml

@@ -1,4 +1,4 @@
 # Update these values when a new release is created.
 # `stacks-common/build.rs` will automatically update `versions.rs` with these values.
-stacks_node_version = "3.3.0.0.4"
-stacks_signer_version = "3.3.0.0.4.0"
+stacks_node_version = "3.3.0.0.5"
+stacks_signer_version = "3.3.0.0.5.0"