Signature verification failure in Tendermint
Summary
GHSA-f3w5-v9xx-rp8p: Signature verification failure in Tendermint. Affects github.com/tendermint/tendermint versions >= 0.34.0, < 0.34.9. Fixed in 0.34.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tendermint is an open-source blockchain platform that provides a secure and scalable consensus engine. It is implemented in Go and is widely used in various blockchain applications. However, versions 0.34.0 to 0.34.8 of Tendermint are vulnerable to a signature verification failure, which can lead to a new type of attack called a 'forward lunatic attack' (FLA). FLAs can be executed by malicious validators with a significant amount of voting power and can result in the execution of arbitrary application state associated with a block height that hasn't been seen yet. This vulnerability has a moderate severity level and affects Tendermint light clients.
Vulnerability Detail
The vulnerability in Tendermint allows malicious validators to sign commit messages for application state associated with a future block height. This type of attack, known as a forward lunatic attack (FLA), targets a block height higher than the current block and can bypass the detection and punishment mechanisms of Tendermint. While FLAs are only possible outside of Tendermint's security model, it is crucial to detect and punish such attacks to incentivize correct behavior. The vulnerability has been patched in Tendermint Core v0.34.9, which handles all evidence of FLAs automatically and on-chain.
How To Fix
Minimum fixed version
0.34.9
This is the first release that contains the fix.
go get github.com/tendermint/tendermint@v0.34.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. Upgrading to Tendermint Core v0.34.9 is the only solution to address the issue.
Conclusion
The signature verification failure vulnerability in Tendermint can lead to forward lunatic attacks, where malicious validators can sign commit messages for future block heights. This vulnerability has been patched in Tendermint Core v0.34.9, and all users are advised to upgrade to this version to prevent potential loss of funds. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/tendermint/tendermint →
FAQ
Tendermint is an open-source blockchain platform that provides a secure and scalable consensus engine. It is widely used in various blockchain applications.
A forward lunatic attack is a type of attack in which a malicious validator signs commit messages for application state associated with a future block height. This attack can bypass the detection and punishment mechanisms of Tendermint.
The severity of this vulnerability is moderate.
To fix the vulnerability, you need to upgrade to Tendermint Core v0.34.9, which includes the necessary patches to detect and handle forward lunatic attacks.
No, there are no known workarounds for this vulnerability. Upgrading to Tendermint Core v0.34.9 is the only solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/tendermint/tendermint.
