Harden validation, improve runtime security and refactor core services

shared/src/constants.rs

@@ -10,3 +10,4 @@ pub const MAX_MUTATION_ROUNDS: u8 = 10;
 pub const MAX_MUTATION_INSTRUCTION_BUDGET: usize = 2048;
 pub const HASH_OPCODE_INSTRUCTION_COST: usize = 16;
 pub const SOFT_CAP_DURATION_MS: u128 = 50;
+pub const MAX_STACK_DEPTH: usize = 64;

shared/src/hashing.rs

@@ -37,8 +37,8 @@ pub fn next_chain_hash(
     stack: &StackState,
     salt: &[u8],
 ) -> Vec<u8> {
-    let entropy_bytes = serde_json::to_vec(entropy).unwrap();
-    let stack_bytes = serde_json::to_vec(stack).unwrap();
+    let entropy_bytes = serde_json::to_vec(entropy).unwrap_or_default();
+    let stack_bytes = serde_json::to_vec(stack).unwrap_or_default();
 
     let entropy_hash = blake3::hash(&entropy_bytes);
     let stack_hash = blake3::hash(&stack_bytes);
@@ -63,4 +63,3 @@ pub fn hash_stack(stack: &[u32]) -> u32 {
     let hash = blake3::hash(&data);
     u32::from_le_bytes(hash.as_bytes()[..4].try_into().unwrap())
 }
-

shared/src/protocol.rs

@@ -116,4 +116,3 @@ pub struct StackState {
     /// The final instruction pointer location at program completion or termination.
     pub ip: u16,
 }
-

shared/src/vm.rs

@@ -25,6 +25,9 @@ pub fn execute(program: &[u8]) -> StackState {
                     program[ip + 3],
                 ]);
                 ip += 4;
+                if stack.len() >= crate::constants::MAX_STACK_DEPTH {
+                    break;
+                }
                 stack.push(val);
             }
             0x01..=0x07 => {
@@ -43,6 +46,9 @@ pub fn execute(program: &[u8]) -> StackState {
                     0x07 => a.rotate_left(b % 32),
                     _ => unreachable!(),
                 };
+                if stack.len() >= crate::constants::MAX_STACK_DEPTH {
+                    break;
+                }
                 stack.push(r);
             }
             0x08 => {
@@ -50,11 +56,17 @@ pub fn execute(program: &[u8]) -> StackState {
                     break;
                 }
                 let a = stack.pop().unwrap();
+                if stack.len() >= crate::constants::MAX_STACK_DEPTH {
+                    break;
+                }
                 stack.push(!a);
             }
             0x09 => {
                 let r = crate::hashing::hash_stack(&stack);
                 stack.clear();
+                if stack.len() >= crate::constants::MAX_STACK_DEPTH {
+                    break;
+                }
                 stack.push(r);
             }
             _ => break,

shared/src/vm_extensions.rs

@@ -269,7 +269,6 @@ pub fn apply_program(state: &mut GeneState, program: &[u8]) -> Result<(), Mutati
     Ok(())
 }
 
-
 /// Executes the mutation program on the mutable `GeneState` reference for multiple rounds.
 ///
 /// Implements a soft instruction cost-budget cap check to prevent hostile/inefficient