[Security][tentative] High (attackable): Checkpoint Transition Queues Are Not Bound To The Signed Terminal Header

[evonide]

Context

Summit tracks validator-set changes through finalized-header deltas and pending transition queues in consensus state. A checkpoint importer should only install pending add/remove queues that are consistent with the signed terminal header and the finalized history used to reconstruct the active participant set.

Claim

Checkpoint verification applies finalized-header validator deltas to a temporary participant set, but does not bind the decoded checkpoint state's pending added_validators and removed_validators queues to the transition history authenticated by the signed finalized headers.

A malicious checkpoint provider that can provide an otherwise valid finalized-header chain whose terminal header already signs the supplied checkpoint blob can include pending validator-transition queues that are not bound to the signed terminal header deltas. A passive public distributor cannot add or change these queues in an honest checkpoint without changing sha256(checkpoint.data) and failing terminal-header verification.

Flow

The verified-chain path requires checkpoint import/verification, a finalized-header sequence accepted by the checkpoint verifier, a terminal header that authenticates the supplied checkpoint bytes, and decoded checkpoint state whose active membership still passes the final membership check while pending add/remove queues diverge from the header-authenticated transition history.

Impact

A checkpoint can verify against the finalized header chain while carrying pending add/remove queues that produce a different next committee after import. The node can then diverge from the validator set reconstructed from finalized headers, undermining checkpoint soundness and future certificate verification.

Root Cause

Checkpoint verification authenticates active membership through the finalized headers but omits an equality check between serialized checkpoint transition queues and the terminal header's committed validator deltas.

Code

• Last-block aux data puts next-epoch added_validators and current removals into the Summit block header: https://github.com/SeismicSystems/summit/blob/ed2c5c8/finalizer/src/actor.rs#L962.
• Application verification checks a block header's validator deltas against local aux data: https://github.com/SeismicSystems/summit/blob/ed2c5c8/application/src/actor.rs#L670.
• Checkpoint verifier applies header deltas only to an accumulated temporary participant set: https://github.com/SeismicSystems/summit/blob/ed2c5c8/types/src/checkpoint.rs#L249.
• The verifier requires the terminal header's checkpoint_hash to equal sha256(checkpoint.data), so public redistribution alone cannot alter the queues in an already-signed checkpoint: https://github.com/SeismicSystems/summit/blob/ed2c5c8/types/src/checkpoint.rs#L263.
• Its final checkpoint-state check compares active account membership, but ignores decoded checkpoint_state.added_validators and checkpoint_state.removed_validators: https://github.com/SeismicSystems/summit/blob/ed2c5c8/types/src/checkpoint.rs#L282, https://github.com/SeismicSystems/summit/blob/ed2c5c8/types/src/checkpoint.rs#L317.
• The transition queues are serialized checkpoint state and later drive epoch transition after import: https://github.com/SeismicSystems/summit/blob/ed2c5c8/types/src/consensus_state.rs#L1028, https://github.com/SeismicSystems/summit/blob/ed2c5c8/finalizer/src/actor.rs#L1163.

Related Issues/PRs

Related issues cover adjacent checkpoint queue, epoch-boundary state-root, and pending-state omissions that can leave transition state under-bound.

• [Security][tentative] High (attackable): Checkpoint Startup Accepts Unauthenticated Artifacts #214
• [Security][tentative] High (attackable): Checkpoint State Position Is Not Bound To The Verified Header Chain #215
• [Security][tentative] High (attackable): Checkpoint Verification Does Not Bind Validator Consensus Keys #217
• [Security][tentative] High (attackable): Checkpoint Verifier Ignores Funds State #219
• [Security][tentative] Medium (correctness): Checkpoint Restart Drops Exiting Validators Early #238
• [Security][tentative] Medium (correctness): Epoch Transition Root Is Captured Before Boundary Mutations #243
• [Security][tentative] Medium (attackable): Pending Checkpoint Digest Is Not Validated #253
• [Security][tentative] Medium (attackable): SSZ State Root Omits Pending Checkpoint #258
• [Security][tentative] Medium (correctness): SSZ State Root Omits Pending Execution Requests #259

Fix

• Compare decoded transition queues against the terminal finalized header's committed validator deltas and expected post-boundary state.
• Reject checkpoint states with pending add/remove queues inconsistent with the verified header chain.
• Add negative tests where a signed terminal header has one validator transition set but the checkpoint state carries another.

[matthias-wright]

Proposed fix: #423