Offers with invalid maker tx in the orderbook

[alexblom102]

Description

There exist an issue where offers can be published with invalid maker fees.

Version

1.9.12

Steps to reproduce

1. Fund the Bisq wallet.
2. Double spend the funds away from the Bisq wallet.
3. The funds will stay under "Available balance" forever(?). You are now able to create and publish offers with non-existing maker fees.

Details

Thanks to the enabling of "disableMempoolValidation"(?) filter, anyone who tries to take an invalid offer are presented with:
"This offer is not valid. Please choose a different offer.
[Tx not found]"
The offer is deactivated after a couple minutes, however, a malicious client could reenable the offer programmatically.
There doesn't seem to be any onion-address banning for misbehaving clients.

Impact

Malicious actors can spam the orderbook with offers at almost zero cost, advertising/luring victims off-platform with the "Additional information" field, all without paying any maker fees or risking losing their deposit.

Remediation suggestions

1. Implement checks at the broadcasting/publishing stage (currently the check/filter only happens when someone tries to take an offer(?)).
2. Ban onion-addresses that misbehave. (This would only increase the cost slightly for the malicious actor as a new double spend is required for each new onion-identity.)

[boring-cyborg]

Thanks for opening your first issue here!

Be sure to follow the issue template. Your issue will be reviewed by a maintainer and labeled for further action.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[github-actions]

This issue has been automatically closed because of inactivity. Feel free to reopen it if you think it is still relevant.

[pazza83]

Hi @alexblom102 AFAIK the trade fee filter has been turned back on so offers with an invalid maker fee should no longer appear in the offer book.

[alexblom102]

Hi @alexblom102 AFAIK the trade fee filter has been turned back on so offers with an invalid maker fee should no longer appear in the offer book.

Indeed it has, however, it only prevents peers from taking invalid offers. The problem is that invalid offers can still be broadcast and put in the order book. The mechanism used for deactivating these invalid orders can be bypassed.

[pazza83]

Looks like there was a PR to fix this here: #6615

@jmacxx is it possible for someone to broadcast offers with a failed maker fee?