Killing Filecoin nodes
Summary: Trail of Bits identified and reported a vulnerability in the Lotus and Venus clients of the Filecoin network that let an attacker remotely crash a node and trigger a denial of service. The flaw came from an incorrect validation of an index: a peer-controlled message index was cast to a signed integer, so a value above the signed integer max became negative and bypassed the length check, causing an index out-of-range panic during syncing and the Hello protocol. Lotus fixed it in version 1.25.2 and Venus in version 1.14.3 by casting to unsigned integers.
Why it matters: A single peer-supplied index was enough to take a Filecoin node down, and the same signed-integer pattern is common across blockchain node codebases - the fix required only a one-condition check on unsigned integers.
Read the original at Trail of Bits Blog ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026