Security Firm Halborn Discovers Zero-Day Vulnerabilities Affecting Dogecoin, Litecoin, Zcash, and More 280 Networks

Halborn, a blockchain security company, issued a document saying that in March 2022, Halborn was hired to assess whether there were any vulnerabilities in the Dogecoin open source code base that might affect blockchain security. Fixed by Dogecoin team. However, after a broader review, Halborn determined that the same vulnerability, which Halborn codenamed Rab13s, affected more than 280 other networks, including Litecoin and Zcash, putting more than $25 billion in digital assets at risk. The Rab13s vulnerability, discovered in the P2P messaging mechanism of the affected network, could allow an attacker to send maliciously crafted consensus messages to individual nodes, causing each node to shut down and ultimately exposing the network to 51% attacks and other serious threats. problems and other risks. A second vulnerability in the RPC service could allow an attacker to crash a node via RPC requests. However, successful exploitation requires valid credentials, which reduces the likelihood of the entire network being at risk as some nodes execute a stop command. The third vulnerability allows an attacker to execute code in the context of a user running a node via RPC. But this exploit is less likely because it requires valid credentials to perform the attack. Halborn said it has developed an exploit kit for Rab13s that includes a proof of concept with configurable parameters to demonstrate attacks on different networks. All necessary technical information has been shared with identified stakeholders to help them fix bugs and release necessary patches for the community and miners. For projects using UTXO-based nodes (such as Dogecoin), it is recommended to upgrade all nodes to the latest version (1.14.6). Due to the severity of the issue, Halborn will not release further technical or exploit details at this time.