x/sequencers: fix DOS/inefficiency in getSequencerDecreasingBonds

[danwt]

dymension/x/sequencer/keeper/sequencer.go

Lines 209 to 226 in acd9d13

	// getSequencerDecreasingBonds returns the bond reduction item given sequencer address
	func (k Keeper) getSequencerDecreasingBonds(ctx sdk.Context, sequencerAddr string) (bds []types.BondReduction) {
	prefixKey := types.DecreasingBondQueueKey
	store := prefix.NewStore(ctx.KVStore(k.storeKey), prefixKey)
	iterator := sdk.KVStorePrefixIterator(store, []byte{})
	defer iterator.Close() // nolint: errcheck
	for ; iterator.Valid(); iterator.Next() {
	var bd types.BondReduction
	k.cdc.MustUnmarshal(iterator.Value(), &bd)
	if bd.SequencerAddress == sequencerAddr {
	bds = append(bds, bd)
	}
	}
	return
	}

iteration over ever reducing sequencer in end block and in slash and in the message handler is a DOS/easy way to raise other gas price?

[danwt]

reopened : Attackers can leverage the bond reduction mechanism to perform DoS

In x/sequencer/keeper/bond_reductions.go:13-26, the HandleBondReduction function executed in the EndBlocker of the sequencer module
22
DRAFT – NOT INTENDED TO BE SHARED
retrieves bondReductionIDs using the GetMatureDecreasingBondIDs method and processes the resulting list in a loop.
An attacker could exploit this by spamming the MsgDecreaseBond message with small amounts repeatedly, thereby generating a large list of bondReductionIDs.
Since there is no limit on the size of this list, the iteration through the bondReductionIDs can become computationally expensive. This could result in significant delays during block processing, or in the worst case, a complete halt of the chain, leading to Denial of Service.
Similarly in x/sequencer/keeper/unbond.go:148-155, the unbond function, executed in the EndBlocker of the sequencer module, is responsible for removing a sequencer and cleaning up its associated state. Part of this process involves looping through and deleting any active bondReductionIDs entries tied to the sequencer.
Since the unbond function is also used for jailing a sequencer in the EndBlocker of the rollapp module, an attacker could manipulate the system by creating an excessively large list of bondReduction entries. This could delay or prevent jailing and instead lead to a chain halt, effectively weaponizing the bond reduction process to avoid punishment.
Recommendation
We recommend implementing a minimum unbond amount and a cap of unbondings per sequencer like in the canonical staking module.

[danwt]

superseded by #1328