vm: add two proof verifier to fix the vulnerability in range proof

[unclezoro]

Description

This PR aims to solve the BSC Bridge exploitation issue.

Rationale

BC to BSC cross-chain communication is based on the light client technique. A smart contract is deployed on BSC to track the consensus state of BC including the appHash (analogous to stateRoot of Ethereum), which is essentially a root of a verifiable key-value store implemented as an AVL tree. Messages coming from BC will be verified against the appHash so their integrity can be guaranteed.

The store allows consecutive key-value pairs to be proved in batch (better in performance than proving each one individually). However its range proof verification logic contains a critical bug that can be exploited to prove membership of arbitrary key-value pairs chosen by the attacker.

https://github.com/cosmos/iavl/blob/6c1300ae54a9bb851e77dbcc4ba4b21832279027/proof_path.go#L70

https://github.com/cosmos/iavl/blob/6c1300ae54a9bb851e77dbcc4ba4b21832279027/proof.go#L79

The root is calculated by hashing repeatedly (just like in Merkle proof) as in the pseudocode below:

If both left and right exist, the digest will ignore the right field. Because of this, if the verification path contains all items with both left and right, the root is unchanged with any arbitrary right values (using the same leaf). This is one factor to be exploited.

This PR in tendermint will introduce ProofOpVerifier to disable following ProofOperation:

1. The absence proof operator;
2. The value proof operator with more than one leaves.

Example

Refer to the UT.

Changes

NA

[zb3]

Out of curiosity (as an outsider), wouldn't the right package to change be the iavl library? The fix could then be merged upstream. Or I'm missing something?

[unclezoro]

Out of curiosity (as an outsider), wouldn't the right package to change be the iavl library? The fix could then be merged upstream. Or I'm missing something?

We can not change iavl library to the right logic directly, because BSC should support replay block from genesis to latest, it means even the exploitation transaction should be compatibly executed. That is why we did not change the iavl lib, but added two verifiers here.