# Batcher frames are incorrectly decoded leading to consensus split

op-node's frame decoder accepts a frame missing the mandatory is_last byte, letting a malicious sequencer cause a consensus split between clients.

- Payout: Contest reward
- Severity: medium
- Program: Optimism
- Credited: obront
- Disclosed: 2023-01-19
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-01-optimism-judging/issues/279
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-optimism%3AM-1
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:medium tech:go technique:parser-differential technique:source-review vuln:dos vuln:misconfiguration

**Target:** op-node rollup derivation frame parser (frame.go UnmarshalBinary)
**Root cause:** UnmarshalBinary reads the is_last byte but ignores io.EOF, and ParseFrames also ignores io.EOF, so a frame truncated before is_last is accepted with IsLast=false instead of being rejected.
**Steps:**
1. Craft a channel split into two frames.
2. Omit the is_last byte from the first frame.
3. Ensure that truncated frame is the last frame in the frames buffer/package.
4. ParseFrames calls UnmarshalBinary, ReadByte returns EOF with isLastByte=0, sets IsLast=false, returns EOF.
5. ParseFrames ignores EOF and appends the invalid frame, accepting it.
**How found:** Read the derivation spec stating is_last is mandatory and any other value makes the frame invalid, then compared against frame.go's UnmarshalBinary and noticed the EOF error path is skipped and ParseFrames ignores io.EOF.
**Exploitation:** A malicious sequencer submits a batch containing a frame truncated before the is_last byte as the final frame in the package; op-node accepts it while a spec-compliant node rejects it, causing verifiers to diverge from the sequencer.
**Insight:** When a spec marks a field mandatory, check the parser's behavior on truncated input at buffer boundaries: Go's ReadByte returns 0 with io.EOF, and callers that treat io.EOF as benign will silently accept a missing trailing field.