RequestTracker allows arbitrary gaps across request flows #68

New Issue

Skipper · 2026-04-05T16:23:09Z

Skipper commented

2026-04-05 16:23:09 +00:00

Info

Severity: LOW
Attack vector: network-only

Impact

May let an attacker preallocate request identifiers for later protocol flows, with limited practical effect.

Description

RequestTracker enforces monotonic IDs but permits arbitrary gaps and does not track IDs separately per request kind. That weakens sequencing guarantees across unrelated flows.

Example flow

Send requests that advance the global request counter.
Leave large gaps in the accepted ID space.
Reuse expectations about future request IDs in another flow.
Benefit from weaker request sequencing guarantees.

Mitigation

Track request identifiers per flow or request type and tighten validation of expected sequences.

# Info **Severity**: **LOW** Attack vector: network-only ## Impact May let an attacker preallocate request identifiers for later protocol flows, with limited practical effect. ## Description `RequestTracker` enforces monotonic IDs but permits arbitrary gaps and does not track IDs separately per request kind. That weakens sequencing guarantees across unrelated flows. ## Example flow 1. Send requests that advance the global request counter. 2. Leave large gaps in the accepted ID space. 3. Reuse expectations about future request IDs in another flow. 4. Benefit from weaker request sequencing guarantees. ## Mitigation Track request identifiers per flow or request type and tighten validation of expected sequences.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MarketTakers/arbiter#68