0xtruthlover

Writing

Thoughts, findings and disclosures. What I learn hunting bugs, written down once the programs allow it.

  1. DisclosureHigh severity:A block one Solana client killed and the other voted forA validly signed block from one leader can split Solana's two validator clients onto forks that won't rejoin on their own.
  2. DisclosureHigh severity:40,400 signature checks for a Stellar transaction nobody paid forAn invalid, fee-free Stellar transaction could make every validator that saw it run 40,400 Ed25519 checks on one shared thread.
  3. DisclosureMedium severity:A free Flow dry run that would take 7,300 years to finishFlow's EVM dry run never charged for gas, so one free script could start a loop on an Access Node that no timeout could stop.
  4. DisclosureCritical severity:One println could crash every gno.land validatorPrinting a big slice in a gno.land contract used memory the VM never counted. One cheap transaction could kill every validator in the same block.