Security researcher Doyeon Park disclosed on April 21 that there is a critical high-severity zero-day vulnerability in the Cosmos consensus layer CometBFT, rated at CVSS 7.1. It could allow malicious peers to attack nodes during the BlockSync stage of block synchronization and lead them into a deadlock, impacting a network that safeguards more than $8 billion in assets.
Vulnerability technical principle: infinite deadlock caused by malicious nodes reporting high blocks repeatedly
The vulnerability exists in CometBFT’s BlockSync mechanism. Under normal circumstances, when connecting, peers report incrementally increasing latest block heights. However, the current code does not verify the scenario where a peer reports a higher height X first and then reports a lower height Y—for example, reporting 2000 first and then 1001. In that case, the node in synchronization (node A) will wait indefinitely to catch up to height 2000, even if the malicious peer disconnects; the target height will not be recalculated, causing the node to fall into an infinite deadlock and be unable to rejoin the network. Affected versions are <= v0.38.16 and v1.0.0. Patched versions are v1.0.1 and v0.38.17.
Coordinated disclosure failure: complete timeline of the vendor downgrading the CVE
Park followed the standard Coordinated Vulnerability Disclosure (CVD) process, but the process encountered multiple obstacles: on February 22, Park submitted the first report; the vendor requested it be submitted in the form of a public GitHub issue but refused to disclose publicly. On March 4, the second report was marked as spam by HackerOne. On March 6, the vendor unilaterally downgraded the severity from “medium/high” to “informational (impact is negligible).” Park submitted a network-level concept proof (PoC) to rebut the downgrade. On April 21, the final decision was made to disclose publicly.
Park also noted that the vendor had previously performed similar downgrade actions for the CVE-2025-24371 vulnerability, which has the same impact, and this is considered to violate internationally recognized vulnerability assessment standards such as CVSS.
Emergency guidance: actions validators need to take now
Before the patch is formally deployed, Park recommends that all Cosmos validators avoid restarting nodes as much as possible. Nodes that are already in consensus mode can continue running normally; however, if restarted and entering the BlockSync synchronization process, they may become stuck in a deadlock due to attacks by malicious peers.
As a temporary mitigation: if BlockSync becomes stuck, you can identify malicious peers that report invalid heights by increasing the log level, and then block that peer at the P2P layer. The most fundamental solution is to upgrade as soon as possible to the patched version v1.0.1 or v0.38.17.
Frequently asked questions
Can this CometBFT vulnerability directly steal funds?
No. This vulnerability cannot directly steal assets or put funds on-chain security at risk. Its impact is to cause nodes to enter a deadlock during the BlockSync synchronization phase, preventing nodes from participating normally in the network. This may affect validators’ ability to propose blocks and cast votes, thereby impacting the activity of the related blockchain.
How can validators determine whether a node has been attacked by this vulnerability?
If a node is stuck in the BlockSync phase, the target height stopping its increase is a possible sign. You can increase the log level of the BlockSync module, check whether there are records of peer nodes that have received anomalous height messages, in order to identify potential malicious nodes, and then block them at the P2P layer.
Is it standard for the vendor to downgrade the vulnerability to “informational”?
Park’s CVSS score (7.1, high severity) is based on standard international scoring methodologies, and Park also submitted a verifiable network-level PoC to rebut the downgrade decision. When the vendor downgraded it to “impact is negligible,” the security community considers this to violate internationally recognized vulnerability assessment standards such as CVSS. This controversy is also one of the core reasons Park ultimately decided to disclose publicly.
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
Misty 23pds Alert: Lazarus Group releases a new macOS toolkit targeting cryptocurrencies
Misty’s Chief Information Security Officer 23pds issued an alert on April 22, stating that the North Korean hacking group Lazarus Group has released a new native macOS malware toolkit called “Mach-O Man,”专a专专专專專專 specialized in the cryptocurrency industry and high-value enterprise executives.
MarketWhisper19m ago
Venus Protocol 攻擊者轉移 2301 枚 ETH，流入 Tornado Cash 清洗
According to the on-chain analyst Ai Auntie’s monitoring on April 22, the Venus Protocol attacker transferred 2,301 ETH (about $5.32 million) to address 0xa21…23A7f 11 hours ago, then moved the funds in batches into the crypto mixer Tornado Cash for laundering; as of the time of monitoring, the attacker still held about $17.45 million worth of ETH on-chain.
MarketWhisper2h ago
North Korean Lazarus Group Releases New Mach-O Man macOS Malware Targeting Crypto
Summary: Lazarus Group released a native macOS malware toolkit named Mach-O Man, aimed at crypto platforms and high-value executives; SlowMist warns users to exercise caution against attacks.
Abstract: The article reports that the Lazarus Group has unveiled Mach-O Man, a macOS-native malware toolkit aimed at cryptocurrency platforms and high-value executives. SlowMist warns users to exercise caution to mitigate potential attacks.
GateNews3h ago
A Bitcoin toll scam appeared in the Strait of Hormuz, and after a ship paid, it was still shelled
According to CoinDesk on April 22, the Greek maritime risk services company Marisks issued a warning, saying scammers are impersonating Iranian authorities to send messages to multiple shipping companies and requesting Bitcoin or USDT as a “toll” to pass through the Strait of Hormuz. Marisks confirmed that the relevant messages are not coming through official Iranian channels, and, according to Reuters, said it believes at least one vessel was deceived and was still shelled when it tried to pass over the weekend.
MarketWhisper3h ago
RHEA Finance Security Incident Update: About a $400k shortfall remains, with a commitment to fully compensate it
RHEA Finance has released a follow-up update regarding the security incident on April 16, confirming that there has been tangible progress in recovering assets. As of this update, it is estimated that there is still an approximately $400k funding gap, mainly due to the combination of NEAR, USDT, and USDC in the lending market liquidity pool. RHEA Finance has committed to fully cover any remaining shortfall to ensure that all affected users receive full compensation.
MarketWhisper3h ago
Researcher Discloses Critical CVSS 7.1 Zero-Day Vulnerability in Cosmos Consensus Layer CometBFT
Security researcher Doyeon Park disclosed a CVSS 7.1 zero-day in Cosmos' CometBFT causing potential node freezes during sync; vendor resistance, downgrades, and disclosure led to April 21 reveal; validators should avoid restarts before patch.
Abstract: Security researcher Doyeon Park disclosed a critical CVSS 7.1 zero-day vulnerability in Cosmos' CometBFT consensus layer that could cause nodes to freeze during block synchronization, potentially affecting networks securing over $8 billion in assets. The vulnerability cannot directly steal funds. Park pursued coordinated disclosure beginning Feb 22, but faced vendor resistance to public disclosure and issues with HackerOne. The vendor downgraded a related vulnerability (CVE-2025-24371) to informational on Mar 6, prompting Park to release a network-level proof-of-concept before public disclosure on Apr 21. The advisory recommends Cosmos validators avoid restarting nodes until patches are released; nodes already in consensus may continue but restart and resync could expose them to attacks by malicious peers, risking deadlock.
GateNews3h ago
