Kevin Valerio

Summary: Trail of Bits released gosentry, a fuzzing-oriented fork of the Go toolchain that preserves the standard fuzzing workflow while using a stronger stack underneath. The firm also released go-panikint, a modified Go compiler that turns silent integer overflows into explicit panics, which it used to find a live integer overflow in the Cosmos SDK's RPC pagination logic.
Bottom line: The Cosmos SDK overflow was found in production RPC pagination code that compiled and ran without error, which means the same silent arithmetic bugs can sit undetected in any Go codebase until someone fuzzes for them deliberately.

Read the original at Trail of Bits Blog ↗