Malicious Operator Might Finalize Data From a Forked Linea Chain
A malicious operator (prover) can add and finalize block data from a forked Linea chain, so transactions on the forked chain can be finalized, causing a loss of funds from the L1.\\nFor example, a malicious operator forks the canonical chain, then the attacker sends the forked chain Ether to L1 with `sendMessage` from the forked L2. The operator then submits the block data to L1 and finalizes it with `finalizeCompressedBlocksWithProof`, using the finalization data and proof from the forked chain. (Note that the malicious prover sets the forked chain `chainId` in its circuit as a constant.) The L1 contract (LineaRollup) doesn't know whether the data and the proof are from the canonical L2 or the forked one. The finalization succeeds, and the attacker can claim the bridged forked chain Ether and steal funds from L1.\\nAs there is currently only one operator and it is owned by the Linea team, this kind of attack is unlikely to happen. However, when the operator and the coordinator are decentralized, the likelihood of this attack increases.\\n```\\nuint256 publicInput = uint256(\\n keccak256(\\n abi.encode(\\n shnarf,\\n \\_finalizationData.parentStateRootHash,\\n \\_finalizationData.lastFinalizedTimestamp,\\n \\_finalizationData.finalBlockNumber,\\n \\_finalizationData.finalTimestamp,\\n \\_finalizationData.l1RollingHash,\\n \\_finalizationData.l1RollingHashMessageNumber,\\n keccak256(abi.encodePacked(\\_finalizationData.l2MerkleRoots))\\n )\\n```\\n\\n```\\n\\_addL2MerkleRoots(\\_finalizationData.l2MerkleRoots, \\_finalizationData.l2MerkleTreesDepth);\\n```\\n
Add `chainId` in the `FinalizationData` as a public input of the verifier function `_verifyProof`, so the proof from the forked Linea chain will not pass the verification because the `chainId` won't match.
```\\nuint256 publicInput = uint256(\\n keccak256(\\n abi.encode(\\n shnarf,\\n \\_finalizationData.parentStateRootHash,\\n \\_finalizationData.lastFinalizedTimestamp,\\n \\_finalizationData.finalBlockNumber,\\n \\_finalizationData.finalTimestamp,\\n \\_finalizationData.l1RollingHash,\\n \\_finalizationData.l1RollingHashMessageNumber,\\n keccak256(abi.encodePacked(\\_finalizationData.l2MerkleRoots))\\n )\\n```\\n