From 40907ae285317eaaf6449ff17d40b58a1a5df665 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 13:48:01 +0000 Subject: screen: a signature vouches for its change and what it builds on Review finding 5: vouching by (actor, seq) isn't bound to a hash. A member can make a change under another member's actor at a seq that member's signature covers. The change is then taken as vouched, and if it breaks a rule, the honest member is refused as a whole and logged as the one whose own change broke the rules. A signature now vouches for its change and the changes of its actor it builds on: in the document, as before; among received changes, those it reaches through the batch's dependencies. A received change under an actor at a seq whose change the document holds (a signature verified up to it) is a fork: refused as forged, never as its actor's node's, not told back in REFUSALS, and logged with the peer that brought it. --- src/swarm/sync.rs | 3 +++ 1 file changed, 3 insertions(+) (limited to 'src/swarm') diff --git a/src/swarm/sync.rs b/src/swarm/sync.rs index ef2c1b3..ffdbf07 100644 --- a/src/swarm/sync.rs +++ b/src/swarm/sync.rs @@ -661,6 +661,9 @@ pub(crate) async fn handle_sync( )?; refused_again = outcome.refused_again; roots = outcome.roots; + if outcome.forged > 0 { + tracing::warn!(peer = %peer, forged = outcome.forged, "A peer brought changes forged under another node's actor: refused"); + } } sync.receive_logged(doc, message, log) })(); -- cgit v1.3.1