🐸Smart🐸Contract🐸Programmer🐸

Today I found a vulnerability which allows a proposer to halt Bor (@0xPolygon execution chain). It is a deterministic halt meaning that it's not up to chance. A proposer could halt the chain at will. On my end, I rated the finding as critical, but the protocol team had a different thought. The issue was downgraded to a low and closed as "Duplicate of invalid report". What was the issue? Apparently, polygon considers the Proposer as a trusted role. The argument is that the proposer role represents a supermajority trusted role rather than an arbitrary validator rotation. The funny bit about this is that there is nothing special about this supermajority election. Heimdall validators simply ranks a set of validators and whoever has the super majority becomes the elected proposer. In addition, currently the proposer is no longer a single validator but a set of validators and there is nothing special about their selection. There is nothing about proposer selection on Polygon that justify treating the role as trusted but the team have spoken, a PROPOSER is trusted y'all. yet again, I was not shown the original report (which is invalid by the way) ro which mine was duplicated to, with the infamous excuse that it contains other findings which mine did not include. Since when do white hats submit aggregate reports to immunefi? Let's keep hunting Guys, today is a malicious proposer - chain halt bug, tomorrow could be Theft of funds bug. No dispair! Disclaimer: I only discuss invalid vulnerability reports publicly. I mean there is no reason not to, right?