30s Summary

A smart contract platform, Near Protocol, contained a flaw that could have caused a network-wide shutdown, according to blockchain security firm Zellic, which discovered the issue on September 26. The bug, termed a “Web3 Ping of Death”, had been quietly patched in January, before it could be exploited. Researchers found that double-checking SECP256K1 signatures caused a “panic” response that would have potentially crashed nodes. The vulnerability was tested and confirmed, prompting the Near team to reward Zellic with a $150,000 bounty and issue a patch to their software in January.

Full Article

The Near Protocol, a smart contract platform, was hiding an odd flaw that could have let an attacker zap every node on the network, effectively causing a total shutdown.

This tidbit comes from a report by Zellic, a blockchain security firm that stumbled upon the issue on September 26. They found that the bug was stealthily squashed with a patch back in January. However, there’s a chance that similar flaws could still be lurking in some networks.

In the report, Zellic branded the flaw as a “Web3 Ping of Death” because of its potential to topple an entire network fast. This issue was found while researchers were poking around Near’s peer-to-peer networking protocol for validator nodes, which help its validators have a good conversation with each other.

Nodes on the network chat and recognize each other via a “handshake” containing one of two types of signatures, either Ed25519 or SECP256K1.

While the Ed25519 signature caused no problems, double-checking the SECP256K1 signatures led to a “panic” response that basically freaked out the node.

Stumbling upon this weakness, researchers were stunned that it hadn’t been found in previous tests or caused network crashes already.

It seems like Near dodged a bullet by pure chance. Near node software didn’t have any code that allows for the creation of SECP256K1 type keys. So while the software let nodes accept SECP256K1 signatures, they couldn’t create these signatures.

As a result, no node had ever accidentally caused a network crash by making SECP256K keys and trying to connect to another node.

Even so, a nasty node could tweak the software to generate SECP256K keys. After doing so, they could crash any Near node just by trying to connect. This could result in the entire network sinking like a stone – the dreaded “Web3 Ping of Death.”

To test if the vulnerability was legit, researchers first made a cheeky version of the Near software that included a patch allowing SECP256K keys to be made.

Next, they launched two nodes on a private testnet version of Near. One node ran the official software, while the other ran the mischievous version.

After the first node started producing blocks, the second node tried to crash the first one by exploiting the two vulnerabilities. It turned out that the naughty node succeeded in crashing its counterpart every time.

With the vulnerability under wraps, Zellic secretly told the Near team in December, using HackenProof’s bug bounty platform to make the reveal. The Near team responded by giving Zellic a $150,000 thank you and patching up the node software in January.

Had this not been caught and resolved, the outcome could have been catastrophic. Some blockchain networks haven’t been as fortunate, encountering flaws that led to crashes. For example, in December, the Arbitrum network was out of commission for over an hour, stopping users from making any transactions.

Developers later said that this downtime was due to a deluge of inscription minting, which completely overwhelmed the network.

In January, around half of the Cardano nodes went down thanks to an “anomaly.” This slowed down block production and extended transaction confirmation times, but didn’t stop the network altogether.

In February, the Solana network experienced a crash and wasn’t able to produce a block for over 25 minutes. This was just the latest in a series of Solana crashes that have received a lot of flak from users.

Source: Cointelegraph