Fix: Solved possible security break removing saved random number on p…

…ublish action.
aleph-im · Sep 14, 2023 · 33ef316 · 33ef316
1 parent 8387ff7
commit 33ef316
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/src/aleph_vrf/executor/main.py b/src/aleph_vrf/executor/main.py
@@ -100,7 +100,7 @@ async def receive_publish(hash_message: str) -> APIResponse:
                 f"Random bytes not existing for execution {response_hash.execution_id}"
             )
 
-        random_bytes: bytes = SAVED_GENERATED_BYTES[str(response_hash.execution_id)]
+        random_bytes: bytes = SAVED_GENERATED_BYTES.pop(str(response_hash.execution_id))
 
         response_bytes = VRFRandomBytes(
             request_id=response_hash.request_id,
@@ -115,6 +115,8 @@ async def receive_publish(hash_message: str) -> APIResponse:
 
         message_hash = await publish_data(response_bytes, ref, account)
 
+
+
         response_bytes.message_hash = message_hash
 
         return APIResponse(data=response_bytes)