Immunefi Audit Competitions

Base

Reports by Severity

Critical

74513 - [BC - Critical] unbounded snappy decompression in gossipsub message id fn causes pre validation cpu and memory exhaustion from a mesh peer
75101 - [BC - Critical] zk proof executor uses wrong azul precompile semantics allowing proofs for invalid l2 state roots
74480 - [BC - Critical] gossip snappy decompression missing max gossip size check lets any peer dos base consensus
75554 - [BC - Critical] unbounded snappy decompression in networkpayloadenvelope decode v1 v4 leads to per node memory exhaustion reachable from any unauthenticated p2p peer
74391 - [BC - Critical] missing snappy decoded length bounds in cl gossip enable batched pre validation cpu allocator churn
75504 - [BC - Critical] snappy decompression bomb in gossipsub message handler crashes base nodes
75485 - [BC - Critical] unbounded snappy decompression in gossipsub message id fn causes per message memory spike of 428 mib before validation
75469 - [BC - Critical] gossip payload decoder allocates unbounded snappy output
75962 - [BC - Critical] pre validation decompression bomb in gossipsub leads to deterministic oom 428 mib msg
74657 - [BC - Critical] remote node dos via unbounded snappy decompression in gossip message processing
74656 - [BC - Critical] gossip message id fn performs uncapped snappy decompression before deduplication enabling p2p memory amplification dos
74620 - [BC - Critical] unbounded snappy decompression in base gossip message id computation increases node resource consumption
75305 - [BC - Critical] unbounded memory allocation in gossip message processing allows unauthenticated attacker to freeze block propagation
75301 - [BC - Critical] attacker can dos consensus gossip via unbounded snappy decompression in message id computation
74556 - [BC - Critical] base azul cl unbounded snappy decompression in gossipsub message id fn allows a single unauthenticated p2p message to oom kill every reachable consensus node halting the c
74531 - [BC - Critical] gossipsub message id computation snappy decompresses untrusted payloads without a decompressed size cap
75246 - [BC - Critical] remote snappy compressed p2p block gossip message can force excessive memory and cpu usage in base azul nodes

High

Medium

Low

Insight

Reports by Type

Blockchain/DLT

Smart Contract