Security Research

Vulnerability research in production distributed systems — consensus layers, p2p networking, and financial infrastructure.

Findings

TON Blockchain — High Severity

Unbounded Memory Growth in Simplex Consensus

• 3 bugs: seen_broadcasts_, state_, state_cache_ grow without eviction on finalization
• Affects long-running validators under normal operation (no adversarial action required)
• Byzantine acceleration possible but not required
• Submitted to TON Security Bug Bounty · May 2026

Promise Leak in QUIC Transport Layer

• Two error paths in on_stream_complete() skip responses{} map cleanup
• Memory exhaustion without validator stake — any peer reaching the QUIC endpoint can trigger it
• Submitted to TON Security Bug Bounty · May 2026

CometBFT — High Severity

Unbounded Memory Growth in HeightVoteSet (RemovePeer noop)

• RemovePeer in consensus/reactor.go:228 is a documented noop — peer disconnect never cleans peerCatchupRounds
• roundVoteSets grows via attacker-controlled round numbers before signature verification
• No validator stake required — any p2p peer can trigger it
• Submitted to Cosmos Security · May 2026

TigerBeetle — Medium Severity

Grid Repair Slot Exhaustion via Unthrottled on_request_blocks

• grid_reads pool (4 slots) has no per-source rate limiting
• TODO comment at replica.zig:3347 acknowledges the gap
• Byzantine replica can starve honest replicas' repair requests indefinitely
• Submitted to TigerBeetle team · May 2026

---

Methodology

Static analysis focused on:

• Maps/sets that grow with attacker-controlled keys and lack eviction on finalization
• Per-peer state that survives peer disconnect
• Resource pools with no per-source fairness or rate limiting
• TODO/FIXME comments near memory management code (developers' own acknowledgment of gaps)

Contact

bitsabhi@gmail.com