Skip to content

security: generate_correlation_id is purely a function of ledger sequence #36

Description

@Icahbod

generate_correlation_id in apexchainx_calculator/src/event_correlation.rs only hashes the ledger_sequence; the _outage_id argument is accepted but is explicitly ignored because Soroban SDK 21.x does not expose symbol bytes without conversion. Two unrelated outages processed in the same ledger produce identical correlation IDs, downstream consumers cannot disambiguate workflows without consulting the SLA event, and the ID is trivially guessable from public ledger data. Incorporate the outage identifier into the hash input, e.g. via Symbol::to_string then FNV-1a, or any deterministic transform that yields a u64. Update the test test_correlation_id_changes_with_ledger_sequence to also assert that the same outage across two ledgers AND two different outages in the same ledger produce three distinct correlation IDs.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions