Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@chainsafe/lodestar

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5npmAmendedPublished

    AttesterSlashing number overflow

    CVE-2022-29219 · GHSA-cvj7-5f3c-9vg9

    Affected
    • npm @chainsafe/lodestar < 0.36.0
    Fixed in
    0.36.0· Vendor fix available
    Issue
    Impact Possible consensus split given maliciously-crafted AttesterSlashing or ProposerSlashing being included on-chain. Since we represent uint64 values as native javascript numbers, there is an issue when those variables with large (greater than 2^53) uint64 values are included on chain. In those cases, Lodestar may view valid AttesterSlashing or ProposerSlashing as invalid, due to rounding errors in large number values. This causes a consensus split, where Lodestar nodes are forked away from the main network. Similarly Lodestar may consider invalid ProposerSlashing as valid, thus including in proposed blocks that will be considered invalid by the network. Patches https://github.com/ChainSafe/lodestar/pull/3977 Workarounds Use BigInt to represent Slot and Epoch values in AttesterSlashing and ProposerSlashing objects. BigInt is too slow to be used in all Slot and Epoch cases, so we will carefully use BigInt just where necessary for consensus.

    Recommended action: Upgrade to 0.36.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →