WS-2021-0395

Date: December 15, 2021

Using a flaw in the gossip protocol, a malicious shard member can trick any other fellow shard member into signing an arbitrary message. One way this can be exploited is by creating a transaction transferring funds from the account corresponding to a target node's public key; having the target node sign the transaction data; and then submitting the valid signed transaction to the network, resulting in a loss of funds.

Language: C++