Silent Error in Block Claim Counter Bypasses Rate Limit

[xxcode66-source]

Silent Error in Block Claim Counter Bypasses Rate Limit

Summary

The block claim counter increment error in x/claim/keeper/msg_server_claim.go is silently ignored, potentially allowing the MaxClaimsPerBlock rate limit to be bypassed.

Vulnerability Details

File: x/claim/keeper/msg_server_claim.go
Lines: 85-88

// Increment block claims counter before processing
err = k.IncrementBlockClaimCount(ctx)
if err != nil {
    // nothing to see here - just continue
}

Impact

The processClaim function checks the block claim count at lines 41-47:

claimsCount, err := k.GetBlockClaimCount(ctx)
if err != nil {
    return nil, err
}
if claimsCount >= params.MaxClaimsPerBlock {
    return nil, types.ErrTooManyClaims
}

However, if IncrementBlockClaimCount() fails, the error is silently ignored and the claim continues processing. This means:

1. The rate limit check passes (count < max)
2. Counter increment fails silently
3. Claim is processed without incrementing the counter
4. Next claim in the same block sees the same count
5. Result: Unlimited claims per block if counter increment consistently fails

Root Cause

The comment // nothing to see here - just continue suggests this was intentionally ignored during development, but it creates a security vulnerability.

Proof of Concept

1. Set MaxClaimsPerBlock to a low value (e.g., 10)
2. Submit claims until counter is near the limit
3. If IncrementBlockClaimCount() fails (e.g., due to storage issues, concurrent access), claims continue processing
4. Attacker can submit unlimited claims, bypassing the rate limit

Recommended Fix

Option 1: Fail on error (Recommended)

err = k.IncrementBlockClaimCount(ctx)
if err != nil {
    return nil, fmt.Errorf("failed to increment block claim count: %w", err)
}

Option 2: Retry with backoff

err = k.IncrementBlockClaimCount(ctx)
if err != nil {
    // Retry once
    err = k.IncrementBlockClaimCount(ctx)
    if err != nil {
        return nil, fmt.Errorf("failed to increment block claim count after retry: %w", err)
    }
}

Severity

LOW - Requires specific conditions for counter increment to fail, but violates the intended rate limiting mechanism.

Additional Context

This pattern appears to be a development artifact. The comment suggests it was temporarily ignored but never properly handled. Rate limiting is a critical security mechanism for preventing spam and DoS attacks.

[a-ok123]

claims window closed at the end of 2025, as such no claims can be sent anymore. Claim module is scheduled for removal