**GitHub Issue from [QuipNetwork/quip-protocol](https://github.com/QuipNetwork/quip-protocol/issues/15)** **Author:** @doomhammerhell **Created:** 2026-05-04 21:18:11+00:00 **State:** open --- ### Affected components - `shared/node_client.py:50-104` - message type registry - `shared/node_client.py:115-130` - QUIC message wire format - `shared/network_node.py:2264-2306` - message dispatch - `shared/network_node.py:2315-2332` - `MIGRATE` - `shared/network_node.py:2336-2365` - `PROBE_REQUEST` - `shared/network_node.py:2367-2385` - `LOAD_INFO` - `shared/network_node.py:2389-2431` - `IHAVE` - `shared/network_node.py:2433-2469` - `_send_iwant` - `shared/network_node.py:2471-2498` - `IWANT` ### Severity High. This is a protocol message authenticity and resource-control issue. It does not require breaking TLS; it exploits missing semantic authentication above the transport layer. ### Protocol invariant violated I12 - message authenticity and replay semantics. Messages that mutate state, influence sync/fork choice, trigger propagation, or request expensive work must have explicit sender identity, domain separation, replay rules, expiry, and resource bounds. ### Summary The QUIC datagram frame contains message type, protocol version, request ID, payload length, and payload. It does not include a signed sender identity, chain ID, expiry, monotonic nonce, payload hash, or replay protection. Several handlers then trust fields inside JSON payloads, trigger outbound requests, update peer/load/inventory state, or serve block data. TLS authenticates a channel endpoint; it does not provide global origin authenticity for relayed gossip or semantic replay protection for application messages. ### Technical root cause The wire format is minimal: - `shared/node_client.py:119` documents `[1B msg_type][1B protocol_version][4B request_id][4B payload_len][payload...]`. - `shared/node_client.py:128-130` serializes exactly those fields. No application envelope binds: - sender identity; - chain ID; - message domain; - payload hash; - expiry; - monotonic nonce/sequence; - signature. Handlers then act on unauthenticated payload semantics: - `shared/network_node.py:2315-2332` accepts `MIGRATE` data and acknowledges it. - `shared/network_node.py:2336-2365` accepts `PROBE_REQUEST` and sends a heartbeat to the requested target. - `shared/network_node.py:2377-2379` stores `LOAD_INFO` under a payload-provided `sender`. - `shared/network_node.py:2395-2419` accepts `IHAVE`, records inventory for payload-provided `sender`, and schedules an `IWANT` to that sender. - `shared/network_node.py:2471-2498` serves full block data in response to `IWANT`. ### Adversarial scenario A network adversary with a valid peer connection can: - replay old `IHAVE` announcements to trigger repeated `IWANT` requests; - spoof the `sender` field in `IHAVE` or `LOAD_INFO`; - use `PROBE_REQUEST` to induce third-party heartbeat traffic; - send stale or cross-context control messages because there is no chain ID or expiry; - amplify resource usage by causing parsing, inventory updates, peer scoring updates, block lookup, or outbound connection attempts. This is not a TLS break. It is an application-protocol authentication gap. ### Reproduction / PoC Minimal semantic replay trace: ```python payload = json.dumps({ "block_hash": known_or_random_hash, "block_index": 42, "sender": "victim-or-third-party-peer", }).encode("utf-8") msg = QuicMessage( msg_type=QuicMessageType.IHAVE, request_id=123, payload=payload, ) await node._quic_handle_ihave(msg) ``` Current behavior: 1. Node parses the payload. 2. Node records inventory against the payload-provided sender. 3. If `should_request` is true, node schedules `_send_iwant(sender, block_hash, block_index)`. There is no signed origin, expiry, or replay cache tied to the message semantics. A resource-trigger trace exists for `PROBE_REQUEST`: ```python payload = json.dumps({ "target": "third-party-peer", "probe_id": "replayable-id", }).encode("utf-8") msg = QuicMessage(QuicMessageType.PROBE_REQUEST, 99, payload) await node._quic_handle_probe_request(msg) ``` The node attempts an outbound heartbeat to the chosen target. ### Expected behavior Every state-mutating or resource-triggering message should be wrapped in a signed envelope: ```text Envelope { protocol_version, chain_id, message_type, sender_identity, sequence_or_nonce, expiry, payload_hash, signature } ``` The receiver should verify the signature, enforce expiry, check replay cache, bound payload size before parsing, and apply per-peer rate limits. ### Actual behavior Transport-level protection is used without application-level semantic authenticity. Payload fields are trusted as protocol facts. ### Impact The control plane is vulnerable to replay, spoofing, resource amplification, and peer-state poisoning. For block payloads, signatures may still protect the block itself, but the messages that decide propagation, sync requests, peer inventory, and operational behavior remain under-specified. ### Mitigation - Define a canonical signed message envelope. - Bind message type, chain ID, protocol version, sender identity, payload hash, expiry, and nonce. - Use domain-separated signing labels per message class. - Maintain replay caches per sender and message domain. - Reject unauthenticated state-mutating messages. - Bound payload sizes before JSON decoding or block deserialization. - Add rate limits and request budgets per peer. ### Suggested patch direction Start with high-impact messages: ```text IHAVE, IWANT, BLOCK_SUBMIT, BLOCK_REQUEST, MIGRATE, PROBE_REQUEST, LOAD_INFO ``` Wrap them in: ```python SignedEnvelope( chain_id, protocol_version, msg_type, sender_public_key, nonce, expires_at, payload_hash, signature, payload, ) ``` Then progressively migrate telemetry/read-only endpoints if needed. ### Recommended tests - Unit test: forged `sender` field is rejected. - Replay test: same signed envelope cannot be processed twice. - Expiry test: stale message is rejected. - Domain separation test: signature for `IHAVE` cannot authorize `IWANT`. - Chain ID test: message from another network is rejected. - Resource test: unauthenticated `PROBE_REQUEST` cannot trigger outbound traffic. - Fuzz test: malformed envelope is rejected before expensive parsing. ### Maintainer-facing wording QUIC/TLS gives a protected channel, but the application protocol still needs semantic authentication. Several control-plane messages carry sender or routing semantics inside unsigned payloads and can trigger sync, inventory, peer-load, or outbound probe behavior. I would suggest introducing a signed envelope for state-mutating and resource-triggering messages, with chain ID, message type, sender identity, nonce/expiry, payload hash, and replay checks.