Potential attack-vector in atomic execution protocol about eudico HOT 1 OPEN

Consider also this from @aakoshh:

What if the actor value is wrong? I haven't seen it checked during initialisation. It would mean that some participants never get notifications about results, right?

So what about someone trying to attack like this: Alice, Bob, Charlie and Eve want to participate in a 4 way atomic transaction. Everyone locks their state and give the input CID to Eve. Eve, initialises the atomic swap at the closest common ancestor, but corrupts everyone's actor field except herself. Then she also initialises another swap correctly.

Before the others could submit their outputs, Eve aborts the first atomic swap - since hers is the only correct actor in it, only her subnet gets properly notified; the others go into the dead letters. This notification unlocks her state, but the others don't know this, and they go ahead with the 2nd atomic swap. Eve gets a second notification about the successful swap, but she's already in a state where her state isn't locked.

It seems useless to do this, but the point is that the parent system and the child system are both individually correct, Eve is managing to put them in unexpected states.

Maybe there should be some check that all locked states are only participating in a single atomic swap at any time, in the parent?

Original comment: https://github.com/adlrocha/builtin-actors/pull/13#discussion_r928984624

from eudico.