PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Killing Filecoin nodes

blog.trailofbits.com | blog | #denial-of-service | #vulnerability-disclosure | #blockchain | #trail-of-bits | #filecoin | #index-validation
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Trail of Bits details a DoS bug in Filecoin's Lotus and Venus clients: faulty index validation triggers an out-of-range panic that crashes nodes; fixed by using unsigned integers.
Published
Collected

Related coverage

blog · blog.trailofbits.com
State divergence enables unauthorized access
This coverage gives security teams current context for monitoring, validation, and remediation.
research · certik.com
Inside CertiK's Independent Security Research on Besu
CertiK's chaos-engineering-style testing against a private multi-node Besu testnet uncovered five resource-exhaustion vulnerabilities, patched in Besu 26.7.1 and credited in Besu's release notes.
blog · blog.trailofbits.com
Your AI agent fixed the bug, but what else did it change?
We’re publishing patching-bugs and regression-hunt, two plugins that let engineers delegate patch development and regression checks to agents.
blog · blog.trailofbits.com
Auditing in the age of (good enough) AI
Trail of Bits explains how agents built tooling and a Lean model for the Miden zkVM audit, finding a flaw enabling Falcon signature forgery and yielding 95 machine-checked proofs.
blog · blog.trailofbits.com
1Password's AI patching benchmark is misleading
Trail of Bits says 1Password's FLAWED benchmark misstates AI patch quality, mixing wrong-fix prompts and no-test trials into a 26% clean-fix headline, and ships two agent skills for better fixes.
blog · blog.trailofbits.com
A “proof” of Fermat’s Last Theorem that fits the margin
Trail of Bits found a Lean ≤4.33.1 bug: String.Pos.Raw.extract returns a full string where its spec says empty — enough to 'prove' Fermat's Last Theorem. Not a soundness flaw; fixed in 4.34.0-rc1.
Back