A Bug in the Conf Phase of ABA protocol

[xygdys]

There is a bug in the CONF Phase implement

HoneyBadgerBFT-Python/honeybadgerbft/core/binaryagreement.py

Line 40 in e8bcbc0

broadcast(('CONF', epoch, tuple(bin_values[epoch])))

The message broadcast on line 40 should be values, which is the output of AUX Phase, instead of bin_values. Otherwise, the security guarantees of the AUX round would not take effect!

[zhazhalaila]

I used to think that bin_values[epoch] = values(which is the output of AUX Phase), but it doesn't.
Indeed, we cannot simply assume that bin_values[epoch] = values(which is the output of AUX Phase).
Assume there are four nodes, two of which have inputs of 1 and the other two have inputs of 0.
The following situations may exist:
These nodes decide to broadcast AUX[epoch](1) after receiving n-f EST[epoch](1). And these nodes have received n-f EST[epoch](0) before receiving n-f AUX[epoch](1), then bin_values[epoch]={0, 1} of each node. But each node will only broadcast CONF[epoch](1), because each honest node can only receive n-f AUX[epoch](1) messages (different from EST[epoch](b) messages, each honest node is only allowed to broadcast AUX[epoch](b) messages once).
Therefore, @xygdys is correct.