Prepared by:
HALBORN
Last Updated 11/07/2025
Date of Engagement: September 10th, 2025 - November 4th, 2025
Summary
100% of all REPORTED Findings have been addressed
All findings
68
Critical
5
High
9
Medium
31
Low
17
Informational
6
Table of Contents
- 1. Introduction
- 2. Assessment summary
- 3. Test approach and methodology
- 4. Risk methodology
- 5. Scope
- 6. Assessment summary & findings overview
- 7. Findings & Tech Details
- 7.1 Point validation logic returns inverted results
- 7.2 Randomness manipulation via last-revealer due to linear combinerandoms and weak commit/reveal
- 7.3 Block validation counts retired signers toward majority while threshold uses current signers
- 7.4 Foreign parent acceptance in proof validation
- 7.5 Missing fork-choice policy enables persistent divergence
- 7.6 Unauthenticated consensus metadata parsing allows state manipulation
- 7.7 Unauthenticated peer state updates allow liveness disruption
- 7.8 Unsigned consensus metadata allows client state manipulation
- 7.9 Missing signature verification in receivedownloadrequest
- 7.10 Message signature check bypass for methodcode=0
- 7.11 Quorum computed from registered signers but waits use liveness
- 7.12 Dynamic membership without per-round snapshot (shifting quorum threshold)
- 7.13 Missing anti-equivocation detection enables double-voting
- 7.14 Nondeterministic tie-handling in vrf selection
- 7.15 Unrestricted deserialization of incoming proof lists
- 7.16 Height calculation uses incorrect peer collection after validator connectivity check
- 7.17 Authentication handshake vulnerable to replay attacks
- 7.18 Uncaught parsing exception enables handshake denial of service
- 7.19 Unauthenticated validator discovery enables network topology manipulation
- 7.20 Unsafe string slicing on untrusted wallet version causes connection failures
- 7.21 Address-based bans applied before authentication
- 7.22 Unbounded field lengths in handshake and validator models
- 7.23 Fire-and-forget broadcasts without error handling or flow control
- 7.24 Missing validator role assertion in block reception
- 7.25 Synchronous remote port check in handshake path
- 7.26 Missing address–publickey binding in validator handshake
- 7.27 Silent exception handling hides abuse and operational faults
- 7.28 Unbounded winner list responses without pagination or size limits
- 7.29 Block broadcast not gated on validation success
- 7.30 Excessive parallel requests and static backoff
- 7.31 Unsafe response parsing risks exceptions and desynchronization
- 7.32 Unchecked split-based parsing in message/hash endpoints
- 7.33 Unbounded transaction broadcast list ingestion
- 7.34 Unsafe timestamp parsing and missing nonce in handshake
- 7.35 Inverted duplicate handling logic in task answer processing
- 7.36 Ip-only gating enables session hijack and misrouting
- 7.37 Unsafe timestamp parsing and missing nonce in blockcaster handshake
- 7.38 Receiveblockval heavy path without signalrqueue/dos guard
- 7.39 Aggressive parallelism/backoff in peer connections and updates
- 7.40 Ip-keyed session mapping enables hijack/misdirection
- 7.41 Dos throttling weaknesses in signalrqueue
- 7.42 Transaction nonce ordering not enforced
- 7.43 Reserve callback/recover lack idempotence; locked balance underflow risk
- 7.44 Missing fee floor and global mempool limits enable economic/space dos
- 7.45 Unbounded deserialization and missing cancellation/backpressure in nodedataprocessor
- 7.46 Signature generation lacks validation for zero components
- 7.47 Signature verification accepts off-curve public keys
- 7.48 Synchronous disposal blocks on asynchronous operations causing potential hangs
- 7.49 Missing dos guard and rate limits on block reception
- 7.50 Missing pre-validation filters on block reception
- 7.51 Premature exit from majority calculation
- 7.52 Synchronous blocking on async disposal
- 7.53 Unbounded growth of message/hash caches
- 7.54 Pre-authentication state and balance validation
- 7.55 Signature reuse map grows without cleanup
- 7.56 Unsafe parsing operations in task answer processing
- 7.57 Unbounded json inputs and unsafe asset name handling
- 7.58 Blockcaster handshake: pre‑authentication state/balance checks
- 7.59 Unsafe parsing and substring oob
- 7.60 Payload fields not cryptographically bound to authenticated identity
- 7.61 Tocttou in per-ip queue accounting (connectioncount/buffercost)
- 7.62 Transaction staleness check depends on download state
- 7.63 Documentation contains spelling errors and misleading descriptions
- 7.64 Hardcoded timeouts and fixed delays without observability
- 7.65 Unauthenticated validator list updates and weak binding checks
- 7.66 Unbounded validator registry growth without pruning or ttl
- 7.67 Vrfnumber endianness dependency can cause cross-platform consensus splits
- 7.68 V4 proof validation lacks committee membership and winner enforcement
1. Introduction
The security review was commissioned by VerifiedX and was performed by Halborn security engineers. The broad scope was defined as an L1 and related consensus code review of the VerifiedX-Core repository and related services, including assessment of legacy and active consensus paths, P2P services, cryptographic primitives, and node/validator networking. The purpose of the engagement was to identify security defects and recommend mitigations to harden consensus, networking, cryptography, and state-handling components.
2. Assessment Summary
The engagement required multiple specialist reviews and took place over the period captured in the supplied findings of 40 days. A cross-functional Halborn team was applied and manual review was emphasized alongside automated scans and unit-test verification. The principal goals were detection of cryptographic, consensus, networking, and input‑validation weaknesses and validation of remediations. The overall security posture of the codebase was strong after remediation activity: All issues flagged were fixed, legacy attack surface was removed, and multiple defensive controls were implemented. The most important fixes or improvements identified and confirmed as solved were:
Cryptography: ECDSA signing/verification was hardened (zero-component retries and public-key curve membership checks).
Consensus safety: V4 winner-selection determinism, parent-hash binding, fork-choice rules, and VRF tie/endian handling observations were addressed or documented.
Networking and authentication: Signed consensus metadata, nonce-based handshake protection, replay prevention, and address–publicKey binding were implemented.
Input validation and DoS hardening: JSON size/depth limits, safe parsing (TryParse), rate limiting, SignalRQueue global caps, and pre-validation checks for blocks and proofs were applied.
Legacy code removal: Deprecated consensus paths and unused methods that exposed theoretical risks were removed or guarded, reducing attack surface.
A consolidated remediation state of "Solved" was reported for all of the findings in the provided dataset.
3. Test Approach and Methodology
The assessment was executed by sequencing discovery, targeted manual review, and automated analysis. Initial repository reconnaissance and scoping was performed to identify active execution paths versus legacy/unused code. Manual code review was then applied to high‑risk components (consensus, cryptography, P2P servers, and state application). Automated static analysis and unit-test review was used to surface parsing errors, unsafe APIs, and deserialization risks. A verification phase was performed where developer-supplied remediation comments, commits, and unit test results were examined to confirm fixes.
The phases were as follows:
Research and scoping: repository mapping and identification of active versus legacy code paths.
Manual secure-code review: focused inspection of consensus algorithms, ECDSA/Elliptic Curve handling, message parsing, handshake logic, and P2P endpoints.
Automated scans and tooling: static analyzers and JSON/serialization safety checks (details in Automated Testing section).
Remediation verification: confirmation of applied fixes via code comments, commit references, and unit-test evidence when provided.
A balance was maintained between manual and automated work: manual review was prioritized for design-level consensus and cryptography issues while automated checks were used to validate input-parsing, deserialization, and potential DoS vectors. Confidence in coverage was increased by cross-validating manual findings with remediation evidence and unit tests provided in the context data.
4. RISK METHODOLOGY
Every vulnerability and issue observed by Halborn is ranked based on two sets of Metrics and a Severity Coefficient. This system is inspired by the industry standard Common Vulnerability Scoring System.
The two Metric sets are: Exploitability and Impact. Exploitability captures the ease and technical means by which vulnerabilities can be exploited and Impact describes the consequences of a successful exploit.
The Severity Coefficients is designed to further refine the accuracy of the ranking with two factors: Reversibility and Scope. These capture the impact of the vulnerability on the environment as well as the number of users and smart contracts affected.
The final score is a value between 0-10 rounded up to 1 decimal place and 10 corresponding to the highest security risk. This provides an objective and accurate rating of the severity of security vulnerabilities in smart contracts.
The system is designed to assist in identifying and prioritizing vulnerabilities based on their level of risk to address the most critical issues in a timely manner.
4.1 EXPLOITABILITY
Attack Origin (AO):
Captures whether the attack requires compromising a specific account.
Attack Cost (AC):
Captures the cost of exploiting the vulnerability incurred by the attacker relative to sending a single transaction on the relevant blockchain. Includes but is not limited to financial and computational cost.
Attack Complexity (AX):
Describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability. Includes but is not limited to macro situation, available third-party liquidity and regulatory challenges.
Metrics:
| EXPLOITABILITY METRIC () | METRIC VALUE | NUMERICAL VALUE |
|---|---|---|
| Attack Origin (AO) | Arbitrary (AO:A) Specific (AO:S) | 1 0.2 |
| Attack Cost (AC) | Low (AC:L) Medium (AC:M) High (AC:H) | 1 0.67 0.33 |
| Attack Complexity (AX) | Low (AX:L) Medium (AX:M) High (AX:H) | 1 0.67 0.33 |
Exploitability is calculated using the following formula:
4.2 IMPACT
Confidentiality (C):
Measures the impact to the confidentiality of the information resources managed by the contract due to a successfully exploited vulnerability. Confidentiality refers to limiting access to authorized users only.
Integrity (I):
Measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of data stored and/or processed on-chain. Integrity impact directly affecting Deposit or Yield records is excluded.
Availability (A):
Measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability. This metric refers to smart contract features and functionality, not state. Availability impact directly affecting Deposit or Yield is excluded.
Deposit (D):
Measures the impact to the deposits made to the contract by either users or owners.
Yield (Y):
Measures the impact to the yield generated by the contract for either users or owners.
Metrics:
| IMPACT METRIC () | METRIC VALUE | NUMERICAL VALUE |
|---|---|---|
| Confidentiality (C) | None (C:N) Low (C:L) Medium (C:M) High (C:H) Critical (C:C) | 0 0.25 0.5 0.75 1 |
| Integrity (I) | None (I:N) Low (I:L) Medium (I:M) High (I:H) Critical (I:C) | 0 0.25 0.5 0.75 1 |
| Availability (A) | None (A:N) Low (A:L) Medium (A:M) High (A:H) Critical (A:C) | 0 0.25 0.5 0.75 1 |
| Deposit (D) | None (D:N) Low (D:L) Medium (D:M) High (D:H) Critical (D:C) | 0 0.25 0.5 0.75 1 |
| Yield (Y) | None (Y:N) Low (Y:L) Medium (Y:M) High (Y:H) Critical (Y:C) | 0 0.25 0.5 0.75 1 |
Impact is calculated using the following formula:
4.3 SEVERITY COEFFICIENT
Reversibility (R):
Describes the share of the exploited vulnerability effects that can be reversed. For upgradeable contracts, assume the contract private key is available.
Scope (S):
Captures whether a vulnerability in one vulnerable contract impacts resources in other contracts.
Metrics:
| SEVERITY COEFFICIENT () | COEFFICIENT VALUE | NUMERICAL VALUE |
|---|---|---|
| Reversibility () | None (R:N) Partial (R:P) Full (R:F) | 1 0.5 0.25 |
| Scope () | Changed (S:C) Unchanged (S:U) | 1.25 1 |
Severity Coefficient is obtained by the following product:
The Vulnerability Severity Score is obtained by:
The score is rounded up to 1 decimal places.
| Severity | Score Value Range |
|---|---|
| Critical | 9 - 10 |
| High | 7 - 8.9 |
| Medium | 4.5 - 6.9 |
| Low | 2 - 4.4 |
| Informational | 0 - 1.9 |
5. SCOPE
REPOSITORY
(a) Repository: VerifiedX-Core
(b) Assessed Commit ID: dd57121
(c) Items in scope:
- Scope Overview
- Primary Directories & Files
- P2P/ (8,000+ lines)
↓ Expand ↓
Remediation Commit ID:
- https://github.com/VerifiedXBlockchain/VerifiedX-Core/pull/8
- 71f203a
- a69709e
- f0e8bb1
- 33eb0ec
- 3b2521e
- NA
- d7cb9b5
- c8f095d
- 2dc90e7
- c8fd239
- 4b50cee
- f0e7907
- f684afb
- c22923d
- ee3471f
- 9403c34
- fe79406
- 533df68
- bcd88da
- 1a2e584
- 2c277f1
- 6f2ad36
- cfa8fb5
- 61c7b0e
- 85234d2
- 49a5635
- f71fee7
- f70ab47
- 46edb71
- 667066a
- 2985f08
- 156b8c1
- bfdf82b
- 06e138b
- 66dfc00
- 5c8fc56
- 842485e
- 4f5784a
- 3684968
- https://github.com/VerifiedXBlockchain/VerifiedX-Core/pull/10
- https://github.com/VerifiedXBlockchain/VerifiedX-Core/pull/11
- 0e3ffdb
- 1dfd18e
- 1a29d87
- aab9e83
- f35e354
- 7ecfc83
- 1de47fb
- 0b0134b
- e29ea79
- 7ecfc83
- bec76a1
- 654f7fa
- f8df1aa
- https://github.com/VerifiedXBlockchain/VerifiedX-Core/pull/9/commits/d82893b9c474730bb4ea25bb4de75bf0133441bd
- e2f16b6
- ccf1393
- 83f8ed3
- cb096dc
Out-of-Scope: New features/implementations after the remediation commit IDs.
6. Assessment Summary & Findings Overview
Critical
5
High
9
Medium
31
Low
17
Informational
6
| Security analysis | Risk level | Remediation Date |
|---|---|---|
| Point validation logic returns inverted results | Critical | Solved - 09/25/2025 |
| Randomness manipulation via last-revealer due to linear CombineRandoms and weak commit/reveal | Critical | Solved - 11/02/2025 |
| Block validation counts retired signers toward majority while threshold uses current signers | Critical | Solved - 11/02/2025 |
| Foreign parent acceptance in proof validation | Critical | Solved - 11/02/2025 |
| Missing fork-choice policy enables persistent divergence | Critical | Solved - 11/02/2025 |
| Unauthenticated consensus metadata parsing allows state manipulation | High | Solved - 10/04/2025 |
| Unauthenticated peer state updates allow liveness disruption | High | Solved - 10/25/2025 |
| Unsigned consensus metadata allows client state manipulation | High | Solved - 10/25/2025 |
| Missing signature verification in ReceiveDownloadRequest | High | Solved - 10/26/2025 |
| Message signature check bypass for methodCode=0 | High | Solved - 11/02/2025 |
| Quorum computed from registered signers but waits use liveness | High | Solved - 11/02/2025 |
| Dynamic membership without per-round snapshot (shifting quorum threshold) | High | Solved - 11/02/2025 |
| Missing anti-equivocation detection enables double-voting | High | Solved - 11/02/2025 |
| Nondeterministic tie-handling in VRF selection | High | Solved - 11/02/2025 |
| Unrestricted deserialization of incoming proof lists | Medium | Solved - 10/04/2025 |
| Height calculation uses incorrect peer collection after validator connectivity check | Medium | Solved - 10/04/2025 |
| Authentication handshake vulnerable to replay attacks | Medium | Solved - 10/04/2025 |
| Uncaught parsing exception enables handshake denial of service | Medium | Solved - 10/04/2025 |
| Unauthenticated validator discovery enables network topology manipulation | Medium | Solved - 10/04/2025 |
| Unsafe string slicing on untrusted wallet version causes connection failures | Medium | Solved - 10/04/2025 |
| Address-based bans applied before authentication | Medium | Solved - 10/04/2025 |
| Unbounded field lengths in handshake and validator models | Medium | Solved - 10/04/2025 |
| Fire-and-forget broadcasts without error handling or flow control | Medium | Solved - 10/05/2025 |
| Missing validator role assertion in block reception | Medium | Solved - 10/05/2025 |
| Synchronous remote port check in handshake path | Medium | Solved - 10/25/2025 |
| Missing address–publicKey binding in validator handshake | Medium | Solved - 10/25/2025 |
| Silent exception handling hides abuse and operational faults | Medium | Solved - 10/25/2025 |
| Unbounded winner list responses without pagination or size limits | Medium | Solved - 10/25/2025 |
| Block broadcast not gated on validation success | Medium | Solved - 10/25/2025 |
| Excessive parallel requests and static backoff | Medium | Solved - 10/25/2025 |
| Unsafe response parsing risks exceptions and desynchronization | Medium | Solved - 10/25/2025 |
| Unchecked split-based parsing in message/hash endpoints | Medium | Solved - 10/25/2025 |
| Unbounded transaction broadcast list ingestion | Medium | Solved - 10/26/2025 |
| Unsafe timestamp parsing and missing nonce in handshake | Medium | Solved - 10/25/2025 |
| Inverted duplicate handling logic in task answer processing | Medium | Solved - 10/25/2025 |
| IP-only gating enables session hijack and misrouting | Medium | Solved - 10/25/2025 |
| Unsafe timestamp parsing and missing nonce in blockcaster handshake | Medium | Solved - 10/25/2025 |
| ReceiveBlockVal heavy path without SignalRQueue/DoS guard | Medium | Solved - 10/26/2025 |
| Aggressive parallelism/backoff in peer connections and updates | Medium | Solved - 10/25/2025 |
| IP-keyed session mapping enables hijack/misdirection | Medium | Solved - 10/25/2025 |
| DoS throttling weaknesses in SignalRQueue | Medium | Solved - 10/25/2025 |
| Transaction nonce ordering not enforced | Medium | Solved - 11/02/2025 |
| Reserve CallBack/Recover lack idempotence; locked balance underflow risk | Medium | Solved - 11/04/2025 |
| Missing fee floor and global mempool limits enable economic/space DoS | Medium | Solved - 11/04/2025 |
| Unbounded deserialization and missing cancellation/backpressure in NodeDataProcessor | Medium | Solved - 11/04/2025 |
| Signature generation lacks validation for zero components | Low | Solved - 09/25/2025 |
| Signature verification accepts off-curve public keys | Low | Solved - 09/25/2025 |
| Synchronous disposal blocks on asynchronous operations causing potential hangs | Low | Solved - 10/04/2025 |
| Missing DoS guard and rate limits on block reception | Low | Solved - 10/05/2025 |
| Missing pre-validation filters on block reception | Low | Solved - 10/05/2025 |
| Premature exit from majority calculation | Low | Solved - 10/25/2025 |
| Synchronous blocking on async disposal | Low | Solved - 10/25/2025 |
| Unbounded growth of message/hash caches | Low | Solved - 10/25/2025 |
| Pre-authentication state and balance validation | Low | Solved - 10/25/2025 |
| Signature reuse map grows without cleanup | Low | Solved - 10/25/2025 |
| Unsafe parsing operations in task answer processing | Low | Solved - 10/25/2025 |
| Unbounded JSON inputs and unsafe asset name handling | Low | Solved - 10/25/2025 |
| Blockcaster Handshake: Pre‑Authentication State/Balance Checks | Low | Solved - 10/25/2025 |
| Unsafe parsing and substring OOB | Low | Solved - 10/25/2025 |
| Payload fields not cryptographically bound to authenticated identity | Low | Solved - 10/25/2025 |
| TOCTTOU in per-IP queue accounting (ConnectionCount/BufferCost) | Low | Solved - 10/25/2025 |
| Transaction staleness check depends on download state | Low | Solved - 11/02/2025 |
| Documentation contains spelling errors and misleading descriptions | Informational | Solved - 09/25/2025 |
| Hardcoded timeouts and fixed delays without observability | Informational | Solved - 10/05/2025 |
| Unauthenticated validator list updates and weak binding checks | Informational | Solved - 10/25/2025 |
| Unbounded validator registry growth without pruning or TTL | Informational | Solved - 10/25/2025 |
| VRFNumber endianness dependency can cause cross-platform consensus splits | Informational | Solved - 11/03/2025 |
| V4 proof validation lacks committee membership and winner enforcement | Informational | Solved - 11/02/2025 |
7. Findings & Tech Details
7.1 Point validation logic returns inverted results
//Critical
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.2 Randomness manipulation via last-revealer due to linear CombineRandoms and weak commit/reveal
//Critical
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.3 Block validation counts retired signers toward majority while threshold uses current signers
//Critical
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.4 Foreign parent acceptance in proof validation
//Critical
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.5 Missing fork-choice policy enables persistent divergence
//Critical
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.6 Unauthenticated consensus metadata parsing allows state manipulation
//High
Description
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.7 Unauthenticated peer state updates allow liveness disruption
//High
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.8 Unsigned consensus metadata allows client state manipulation
//High
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.9 Missing signature verification in ReceiveDownloadRequest
//High
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.10 Message signature check bypass for methodCode=0
//High
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.11 Quorum computed from registered signers but waits use liveness
//High
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.12 Dynamic membership without per-round snapshot (shifting quorum threshold)
//High
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.13 Missing anti-equivocation detection enables double-voting
//High
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.14 Nondeterministic tie-handling in VRF selection
//High
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.15 Unrestricted deserialization of incoming proof lists
//Medium
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.16 Height calculation uses incorrect peer collection after validator connectivity check
//Medium
Description
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.17 Authentication handshake vulnerable to replay attacks
//Medium
Description
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.18 Uncaught parsing exception enables handshake denial of service
//Medium
Description
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.19 Unauthenticated validator discovery enables network topology manipulation
//Medium
Description
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.20 Unsafe string slicing on untrusted wallet version causes connection failures
//Medium
Description
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.21 Address-based bans applied before authentication
//Medium
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.22 Unbounded field lengths in handshake and validator models
//Medium
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.23 Fire-and-forget broadcasts without error handling or flow control
//Medium
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.24 Missing validator role assertion in block reception
//Medium
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.25 Synchronous remote port check in handshake path
//Medium
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.26 Missing address–publicKey binding in validator handshake
//Medium
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.27 Silent exception handling hides abuse and operational faults
//Medium
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.28 Unbounded winner list responses without pagination or size limits
//Medium
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.29 Block broadcast not gated on validation success
//Medium
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.30 Excessive parallel requests and static backoff
//Medium
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.31 Unsafe response parsing risks exceptions and desynchronization
//Medium
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.32 Unchecked split-based parsing in message/hash endpoints
//Medium
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.33 Unbounded transaction broadcast list ingestion
//Medium
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.34 Unsafe timestamp parsing and missing nonce in handshake
//Medium
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.35 Inverted duplicate handling logic in task answer processing
//Medium
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.36 IP-only gating enables session hijack and misrouting
//Medium
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.37 Unsafe timestamp parsing and missing nonce in blockcaster handshake
//Medium
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.38 ReceiveBlockVal heavy path without SignalRQueue/DoS guard
//Medium
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.39 Aggressive parallelism/backoff in peer connections and updates
//Medium
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.40 IP-keyed session mapping enables hijack/misdirection
//Medium
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.41 DoS throttling weaknesses in SignalRQueue
//Medium
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.42 Transaction nonce ordering not enforced
//Medium
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.43 Reserve CallBack/Recover lack idempotence; locked balance underflow risk
//Medium
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.44 Missing fee floor and global mempool limits enable economic/space DoS
//Medium
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.45 Unbounded deserialization and missing cancellation/backpressure in NodeDataProcessor
//Medium
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.46 Signature generation lacks validation for zero components
//Low
Description
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.47 Signature verification accepts off-curve public keys
//Low
Description
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.48 Synchronous disposal blocks on asynchronous operations causing potential hangs
//Low
Description
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.49 Missing DoS guard and rate limits on block reception
//Low
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.50 Missing pre-validation filters on block reception
//Low
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.51 Premature exit from majority calculation
//Low
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.52 Synchronous blocking on async disposal
//Low
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.53 Unbounded growth of message/hash caches
//Low
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.54 Pre-authentication state and balance validation
//Low
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.55 Signature reuse map grows without cleanup
//Low
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.56 Unsafe parsing operations in task answer processing
//Low
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.57 Unbounded JSON inputs and unsafe asset name handling
//Low
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.58 Blockcaster Handshake: Pre‑Authentication State/Balance Checks
//Low
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.59 Unsafe parsing and substring OOB
//Low
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.60 Payload fields not cryptographically bound to authenticated identity
//Low
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.61 TOCTTOU in per-IP queue accounting (ConnectionCount/BufferCost)
//Low
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.62 Transaction staleness check depends on download state
//Low
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.63 Documentation contains spelling errors and misleading descriptions
//Informational
Description
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.64 Hardcoded timeouts and fixed delays without observability
//Informational
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.65 Unauthenticated validator list updates and weak binding checks
//Informational
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.66 Unbounded validator registry growth without pruning or TTL
//Informational
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.67 VRFNumber endianness dependency can cause cross-platform consensus splits
//Informational
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
7.68 V4 proof validation lacks committee membership and winner enforcement
//Informational
Description
Proof of Concept
BVSS
Recommendation
Remediation Comment
Remediation Hash
Halborn strongly recommends conducting a follow-up assessment of the project either within six months or immediately following any material changes to the codebase, whichever comes first. This approach is crucial for maintaining the project’s integrity and addressing potential vulnerabilities introduced by code modifications.
Table of Contents
- 1. Introduction
- 2. Assessment summary
- 3. Test approach and methodology
- 4. Risk methodology
- 5. Scope
- 6. Assessment summary & findings overview
- 7. Findings & Tech Details
- 7.1 Point validation logic returns inverted results
- 7.2 Randomness manipulation via last-revealer due to linear combinerandoms and weak commit/reveal
- 7.3 Block validation counts retired signers toward majority while threshold uses current signers
- 7.4 Foreign parent acceptance in proof validation
- 7.5 Missing fork-choice policy enables persistent divergence
- 7.6 Unauthenticated consensus metadata parsing allows state manipulation
- 7.7 Unauthenticated peer state updates allow liveness disruption
- 7.8 Unsigned consensus metadata allows client state manipulation
- 7.9 Missing signature verification in receivedownloadrequest
- 7.10 Message signature check bypass for methodcode=0
- 7.11 Quorum computed from registered signers but waits use liveness
- 7.12 Dynamic membership without per-round snapshot (shifting quorum threshold)
- 7.13 Missing anti-equivocation detection enables double-voting
- 7.14 Nondeterministic tie-handling in vrf selection
- 7.15 Unrestricted deserialization of incoming proof lists
- 7.16 Height calculation uses incorrect peer collection after validator connectivity check
- 7.17 Authentication handshake vulnerable to replay attacks
- 7.18 Uncaught parsing exception enables handshake denial of service
- 7.19 Unauthenticated validator discovery enables network topology manipulation
- 7.20 Unsafe string slicing on untrusted wallet version causes connection failures
- 7.21 Address-based bans applied before authentication
- 7.22 Unbounded field lengths in handshake and validator models
- 7.23 Fire-and-forget broadcasts without error handling or flow control
- 7.24 Missing validator role assertion in block reception
- 7.25 Synchronous remote port check in handshake path
- 7.26 Missing address–publickey binding in validator handshake
- 7.27 Silent exception handling hides abuse and operational faults
- 7.28 Unbounded winner list responses without pagination or size limits
- 7.29 Block broadcast not gated on validation success
- 7.30 Excessive parallel requests and static backoff
- 7.31 Unsafe response parsing risks exceptions and desynchronization
- 7.32 Unchecked split-based parsing in message/hash endpoints
- 7.33 Unbounded transaction broadcast list ingestion
- 7.34 Unsafe timestamp parsing and missing nonce in handshake
- 7.35 Inverted duplicate handling logic in task answer processing
- 7.36 Ip-only gating enables session hijack and misrouting
- 7.37 Unsafe timestamp parsing and missing nonce in blockcaster handshake
- 7.38 Receiveblockval heavy path without signalrqueue/dos guard
- 7.39 Aggressive parallelism/backoff in peer connections and updates
- 7.40 Ip-keyed session mapping enables hijack/misdirection
- 7.41 Dos throttling weaknesses in signalrqueue
- 7.42 Transaction nonce ordering not enforced
- 7.43 Reserve callback/recover lack idempotence; locked balance underflow risk
- 7.44 Missing fee floor and global mempool limits enable economic/space dos
- 7.45 Unbounded deserialization and missing cancellation/backpressure in nodedataprocessor
- 7.46 Signature generation lacks validation for zero components
- 7.47 Signature verification accepts off-curve public keys
- 7.48 Synchronous disposal blocks on asynchronous operations causing potential hangs
- 7.49 Missing dos guard and rate limits on block reception
- 7.50 Missing pre-validation filters on block reception
- 7.51 Premature exit from majority calculation
- 7.52 Synchronous blocking on async disposal
- 7.53 Unbounded growth of message/hash caches
- 7.54 Pre-authentication state and balance validation
- 7.55 Signature reuse map grows without cleanup
- 7.56 Unsafe parsing operations in task answer processing
- 7.57 Unbounded json inputs and unsafe asset name handling
- 7.58 Blockcaster handshake: pre‑authentication state/balance checks
- 7.59 Unsafe parsing and substring oob
- 7.60 Payload fields not cryptographically bound to authenticated identity
- 7.61 Tocttou in per-ip queue accounting (connectioncount/buffercost)
- 7.62 Transaction staleness check depends on download state
- 7.63 Documentation contains spelling errors and misleading descriptions
- 7.64 Hardcoded timeouts and fixed delays without observability
- 7.65 Unauthenticated validator list updates and weak binding checks
- 7.66 Unbounded validator registry growth without pruning or ttl
- 7.67 Vrfnumber endianness dependency can cause cross-platform consensus splits
- 7.68 V4 proof validation lacks committee membership and winner enforcement
// Download the full report
VerifiedX Core
* Use Google Chrome for best results
** Check "Background Graphics" in the print settings if needed