Writing
Thoughts, findings and disclosures. What I learn hunting bugs, written down once the programs allow it.
- High severity:A block one Solana client killed and the other voted forA validly signed block from one leader can split Solana's two validator clients onto forks that won't rejoin on their own.
- High severity:40,400 signature checks for a Stellar transaction nobody paid forAn invalid, fee-free Stellar transaction could make every validator that saw it run 40,400 Ed25519 checks on one shared thread.
- Medium severity:A free Flow dry run that would take 7,300 years to finishFlow's EVM dry run never charged for gas, so one free script could start a loop on an Access Node that no timeout could stop.
- Critical severity:One println could crash every gno.land validatorPrinting a big slice in a gno.land contract used memory the VM never counted. One cheap transaction could kill every validator in the same block.