V1.1.0 bone

[nikashib]

• RLP reader related update and fix
• Polygon’s PR: fix/rlpfix 0xPolygon/pos-contracts#16

Changes found:

• New RLP Reader added

• New deployment script for adding old predicate and removing new one

• Script for deploying new withdraw manager and updating proxy

• MTP related changes and removing drain

• Polygon’s PR: https://github.com/0xPolygon/pos-contracts/pull/21/files v2.2.0 0xPolygon/pos-contracts#19

Changes:

• Updated MerklePatriciaProof file to fix MTP issue
• Removed use of RLP reader in Rootchain contract
• Removed use of RLP reader in WithdrawManager contract
• Removed use of RLP reader in SlashingManager contract
• Removed draining from validatorShare and stakeManager
• Updated the deployment script and added validatorShare and StakeManager updates

MPT Issue
The key security issue here relates to the Merkle Patricia Trie node encoding specification:

1. In MPT, nodes with 2 elements can be either leaf nodes or extension nodes
2. Their prefix nibbles distinguish them:
   • Leaf nodes must have prefix 2 or 3
   • Extension nodes must have prefix 0 or 1

The vulnerability in the original code is that it doesn't validate these prefixes, which means:

1. An attacker could craft a proof where an extension node is treated as a leaf node or vice versa
2. This could lead to invalid proofs being accepted as valid, potentially allowing proof forgery