Security researcher Doyeon Park disclosed on April 21 that there is a critical high-severity zero-day vulnerability in the Cosmos consensus layer CometBFT, rated at CVSS 7.1. It could allow malicious peers to attack nodes during the BlockSync stage of block synchronization and lead them into a deadlock, impacting a network that safeguards more than $8 billion in assets.
Vulnerability technical principle: infinite deadlock caused by malicious nodes reporting high blocks repeatedly
The vulnerability exists in CometBFT’s BlockSync mechanism. Under normal circumstances, when connecting, peers report incrementally increasing latest block heights. However, the current code does not verify the scenario where a peer reports a higher height X first and then reports a lower height Y—for example, reporting 2000 first and then 1001. In that case, the node in synchronization (node A) will wait indefinitely to catch up to height 2000, even if the malicious peer disconnects; the target height will not be recalculated, causing the node to fall into an infinite deadlock and be unable to rejoin the network. Affected versions are <= v0.38.16 and v1.0.0. Patched versions are v1.0.1 and v0.38.17.
Coordinated disclosure failure: complete timeline of the vendor downgrading the CVE
Park followed the standard Coordinated Vulnerability Disclosure (CVD) process, but the process encountered multiple obstacles: on February 22, Park submitted the first report; the vendor requested it be submitted in the form of a public GitHub issue but refused to disclose publicly. On March 4, the second report was marked as spam by HackerOne. On March 6, the vendor unilaterally downgraded the severity from “medium/high” to “informational (impact is negligible).” Park submitted a network-level concept proof (PoC) to rebut the downgrade. On April 21, the final decision was made to disclose publicly.
Park also noted that the vendor had previously performed similar downgrade actions for the CVE-2025-24371 vulnerability, which has the same impact, and this is considered to violate internationally recognized vulnerability assessment standards such as CVSS.
Emergency guidance: actions validators need to take now
Before the patch is formally deployed, Park recommends that all Cosmos validators avoid restarting nodes as much as possible. Nodes that are already in consensus mode can continue running normally; however, if restarted and entering the BlockSync synchronization process, they may become stuck in a deadlock due to attacks by malicious peers.
As a temporary mitigation: if BlockSync becomes stuck, you can identify malicious peers that report invalid heights by increasing the log level, and then block that peer at the P2P layer. The most fundamental solution is to upgrade as soon as possible to the patched version v1.0.1 or v0.38.17.
Frequently asked questions
Can this CometBFT vulnerability directly steal funds?
No. This vulnerability cannot directly steal assets or put funds on-chain security at risk. Its impact is to cause nodes to enter a deadlock during the BlockSync synchronization phase, preventing nodes from participating normally in the network. This may affect validators’ ability to propose blocks and cast votes, thereby impacting the activity of the related blockchain.
How can validators determine whether a node has been attacked by this vulnerability?
If a node is stuck in the BlockSync phase, the target height stopping its increase is a possible sign. You can increase the log level of the BlockSync module, check whether there are records of peer nodes that have received anomalous height messages, in order to identify potential malicious nodes, and then block them at the P2P layer.
Is it standard for the vendor to downgrade the vulnerability to “informational”?
Park’s CVSS score (7.1, high severity) is based on standard international scoring methodologies, and Park also submitted a verifiable network-level PoC to rebut the downgrade decision. When the vendor downgraded it to “impact is negligible,” the security community considers this to violate internationally recognized vulnerability assessment standards such as CVSS. This controversy is also one of the core reasons Park ultimately decided to disclose publicly.
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
When DeFi is too slow for young people and too risky for old money: are we all using Treasury bond interest to shoulder junk bond risk?
DeFi once attracted young people with five-figure APY rates, but it is now seen as overpriced and carrying too much risk. Over the past year, more than $1.62 billion has been stolen, and at one point Aave’s interest rate spiked to 12.4%. The fair yield is about 12.55%, with a retail entry threshold of 18%. Institutional players prefer “strategy-isolated vaults” to reduce tail risk. Conclusion: high leverage is no longer in; in the future, we’ll need higher-risk pricing and insurance tools to accommodate both young people and old money.
ChainNewsAbmedia3h ago
Robinhood Warns of Phishing Emails Sent to Some Customers
Gate News message, April 27 — Robinhood alerted users on social media that some customers received fraudulent emails last Sunday evening claiming to be from noreply@robinhood.com with the subject line "Your recent login to Robinhood."
The phishing attempt stemmed from misuse of the account
GateNews3h ago
Websea Crypto Exchange Faces Suspected Exit Scam, Withdrawal Channels Closed
Gate News message, April 27 — Crypto trading platform Websea has suspended withdrawals and closed its C2C (peer-to-peer) channels, with multiple users reporting the exchange appears to have conducted an exit scam. The platform initially restricted withdrawals before completely shutting down the C2C
GateNews3h ago
RAVE Token Surges 110x in Two Weeks, Then Crashes 98% Amid Market Manipulation Allegations
Gate News message, April 27 — RAVE, the native token of RaveDAO (a Web3-based cultural community project), skyrocketed 110x in two weeks before plummeting 98% over two days on April 19-20, prompting comparisons to the infamous 2007 Lubo stock manipulation scandal in South Korea.
On April 18, RAVE r
GateNews7h ago
Research reveals: Polymarket players take home 30% of profits by winning 3% of the positions—more than 70% of players absorb all losses
A new study analyzes Polymarket’s trading records from 2023–2025 and shows that only 3.14% of experienced winners control more than 30% of the profits. Crowd participation alone is not enough to explain overall accuracy; at the same time, it tracks 1,950 highly suspicious insider trading accounts that, while not driving predictions, amplified price volatility. The case shows that large bets were placed and profits were made before the U.S. announced developments regarding Venezuela. The research questions “wisdom of crowds” and emphasizes the need for increasingly strict regulation.
ChainNewsAbmedia7h ago
France: More than 40 crypto investor kidnappings in 2026, involving leaked tax data
According to Market Forces Africa, reported on April 27, incidents of kidnapping and violent attacks targeting cryptocurrency investors in France have increased sharply. On the X platform, Telegram founder Pavel Durov said that since the beginning of 2026, he has recorded 41 cases of cryptocurrency investor kidnappings, averaging one incident every 2.5 days, and that they are linked to a leak of French tax records.
MarketWhisper8h ago
