A registration accepts a zero-value window that a genesis rule forbids but runtime doesn't
- Severity
- High
- Class
- Consensus & liveness
- System
- On-chain registry module
Anyone can register an entry with a forbidden zero-value setting, permanently squatting a shared name space and denying it to legitimate users.
An invariant enforced at genesis — that a particular window value can't be zero — wasn't re-checked when entries were registered at runtime. So a permissionless registration could carry the very value the network considered impossible.
A zero there wedges the entry into a permanent, unusable state, and because registration is first-come, it locks legitimate users out of that slot for good.
Why it rated High
Permanent, permissionless denial-of-service against a shared registry, cheap to perform and hard to undo.
The fix class
Re-enforce the genesis invariant at runtime registration, not just at chain start.
