NEAR Protocol Addresses Critical Node Vulnerability
Discovering a Major Flaw
A significant vulnerability was identified within NEAR Protocol’s networking framework. This bug had the potential to incapacitate all nodes within the network, effectively halting operations. The issue was pinpointed in the peer-to-peer protocol used by NEAR, which is essential for node communication.
The Threat of Network Collapse
Researchers from Zellic discovered this flaw, which they termed the “Web3 Ping of Death” due to its capability to disrupt an entire network almost instantaneously. The flaw lay in the validation process for signatures used during node communication. While Ed25519 signatures were processed correctly, SECP256K1 signatures triggered a malfunction, leading to node failures.
Understanding the Vulnerability
The flaw was unexpected because NEAR’s software did not have a mechanism to generate SECP256K1 keys. This oversight meant nodes could accept but not produce these types of signatures, inadvertently preventing crashes up to that point. However, a malicious entity could modify the software to generate SECP256K1 keys, leveraging this to disrupt the network.
Proof of Concept and Resolution
To prove the vulnerability, researchers developed a modified version of NEAR’s software that could generate SECP256K1 keys. Testing this on a private network showed that the modified node could indeed crash a legitimate node, confirming the risk.
Zellic discreetly reported the issue to NEAR’s developers through a bug bounty platform. As a result, NEAR promptly released a patch to fix the vulnerability and rewarded Zellic with $150,000 for their critical discovery.
Lessons from Other Networks
NEAR’s proactive approach stands in contrast to other blockchain networks that have experienced similar vulnerabilities. For instance, the Arbitrum and Solana networks both faced notable outages due to various technical issues, underscoring the importance of constant vigilance and preparedness in blockchain security.
Conclusion: The Importance of Security
This incident highlights the vital role of security in blockchain technology. As blockchains become more integral to financial and data systems, ensuring robust security measures is crucial to maintaining trust and stability in decentralized networks.
