Skip to content

fix: add missing hotkey guard in handle_pat_check to prevent ValueError DoS#1302

Open
Tet-9 wants to merge 1 commit into
entrius:testfrom
Tet-9:fix/1297-handle-pat-check-missing-hotkey-guard
Open

fix: add missing hotkey guard in handle_pat_check to prevent ValueError DoS#1302
Tet-9 wants to merge 1 commit into
entrius:testfrom
Tet-9:fix/1297-handle-pat-check-missing-hotkey-guard

Conversation

@Tet-9
Copy link
Copy Markdown
Contributor

@Tet-9 Tet-9 commented May 18, 2026

Summary

handle_pat_check called validator.metagraph.hotkeys.index(hotkey)
without first verifying the hotkey is still registered. When a
metagraph refresh deregisters a hotkey between the blacklist pass and
handler execution — a real TOCTOU window at epoch boundaries —
list.index() raises an uncaught ValueError that crashes the axon
coroutine. The validator stops processing all PatCheckSynapse
requests until manually restarted.

Root Cause

The axon pipeline runs blacklist → priority → handler as separate
async calls with no atomic lock over the metagraph. A hotkey that
passes blacklist_pat_check can be deregistered before
handle_pat_check executes, hitting the unguarded .index() call.

Every sibling function in pat_handler.py already guards this:

Function Guard
handle_pat_broadcast
blacklist_pat_broadcast
priority_pat_broadcast
blacklist_pat_check
priority_pat_check
handle_pat_check ❌ missing

Fix

Apply the same guard already used in handle_pat_broadcast — check
hotkey not in validator.metagraph.hotkeys before calling .index(),
and return a rejected synapse with rejection_reason='Hotkey not registered on subnet' on the missing-hotkey path.

Testing

1475 tests passing, no regressions.

Fixes #1297

@xiao-xiao-mao xiao-xiao-mao Bot added the bug Something isn't working label May 18, 2026
…or DoS

handle_pat_check called validator.metagraph.hotkeys.index(hotkey)
without first checking if the hotkey is still registered. When a
metagraph refresh deregisters a hotkey between the blacklist pass and
the handler execution, list.index() raises an uncaught ValueError that
crashes the axon coroutine — preventing the validator from serving any
further PatCheckSynapse requests until restarted.

Every sibling function already guards this correctly with:
  if hotkey not in validator.metagraph.hotkeys

Apply the same guard to handle_pat_check, returning a rejected synapse
with rejection_reason='Hotkey not registered on subnet' to match the
behavior of handle_pat_broadcast.

Fixes entrius#1297
@Tet-9 Tet-9 force-pushed the fix/1297-handle-pat-check-missing-hotkey-guard branch from 0b01875 to b4488cf Compare May 18, 2026 21:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[CRITICAL] Validator DoS via unguarded .index() in handle_pat_check — TOCTOU race crashes axon handler

1 participant