PT-2026-75921 · Crates.Io · Zaino-State

Published

2026-07-31

·

Updated

2026-07-31

CVSS v4.0

6.9

Medium

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Summary

NonFinalizedState::handle reorg is a recursive, unbounded async function that traverses parent blocks until it finds a common ancestor on the main chain. It has no recursion depth limit and no cycle detection. A malicious or buggy validator can serve a block whose previous block hash points back to itself (or forms a cycle with other blocks), causing handle reorg to infinite-loop, consuming 100% CPU and never making sync progress. Additionally, update() contains an .expect("empty snapshot impossible") that panics if the non-finalized snapshot becomes empty after trimming finalized blocks.

Details

Location: packages/zaino-state/src/chain index/non finalised state.rs:443-489
rust
async fn handle reorg(
  &self,
  working snapshot: &mut NonfinalizedBlockCacheSnapshot,
  block: &impl Block,
) -> Result<IndexedBlock, SyncError> {
  let prev block = match working snapshot
    .get block by hash bytes in serialized order(block.prev hash bytes serialized order())
    .cloned()
  {
    Some(prev block) => {
      if !working snapshot
        .heights to hashes
        .values()
        .any(|hash| hash == prev block.hash())
      {
        Box::pin(self.handle reorg(working snapshot, &prev block)).await? // <-- LINE 459
      } else {
        prev block
      }
    }
    None => {
      let prev block = self
        .source
        .get block(HashOrHeight::Hash(
          zebra chain::block::Hash::from bytes in serialized order(
            block.prev hash bytes serialized order(),
          ),
        ))
        .await
        .map err(|e| { ... })?
        .ok or(SyncError::ValidatorConnectionError(...))?;
      Box::pin(self.handle reorg(working snapshot, &*prev block)).await? // <-- LINE 483
    }
  };
  let indexed block = block.to indexed block(&prev block, self).await?;
  working snapshot.add block new chaintip(indexed block.clone());
  Ok(indexed block)
}
Infinite loop via self-referencing block:
  1. A compromised validator serves a block B where B.prev hash == B.hash.
  2. handle reorg is called with B.
  3. get block by hash bytes in serialized order(B.prev hash) finds B itself in working snapshot.blocks.
  4. Check: is B.hash in working snapshot.heights to hashes? If B is a new chaintip not yet on the main chain, no.
  5. Recurse with prev block = B (the exact same block).
  6. This repeats forever. The async recursion builds a new Box::pin future each iteration, consuming heap memory and CPU.
Stack exhaustion via deep reorg: A deep reorg of >1000 blocks would recurse >1000 times. Each async recursion creates a new Box::pin future on the heap. While this won't exhaust the native stack immediately, it will allocate unbounded heap memory and CPU time, effectively DoS-ing the sync task.
.expect("empty snapshot impossible") panic:
Location: packages/zaino-state/src/chain index/non finalised state.rs:543-548
rust
new snapshot.remove finalized blocks(finalized height);
let best block = &new snapshot
  .blocks
  .values()
  .max by key(|block| block.chainwork())
  .cloned()
  .expect("empty snapshot impossible"); // <-- LINE 548
If finalized height is greater than or equal to all blocks in new snapshot.blocks, remove finalized blocks retains only blocks at or above that height. If none exist, new snapshot.blocks becomes empty. The .expect() then panics. While the comment claims this is "impossible," defensive programming dictates it is reachable under corruption or edge-case sync conditions.

PoC

  1. Run a regtest.
  2. Serve a block where header.previous block hash == block.hash().
  3. Zaino's NonFinalizedState::sync enters handle reorg and infinite-loops.
  4. Sync never completes. CPU usage pegs to 100%. No new blocks are served to clients.

Fix

  1. Add an explicit recursion depth limit (e.g., max 1000 iterations) and return SyncError::ReorgFailure if exceeded:
rust
const MAX REORG DEPTH: usize = 1000;
  1. Track visited hashes in a HashSet<BlockHash> during traversal to detect cycles and abort with an error.
  2. Replace .expect("empty snapshot impossible") with a proper Err(UpdateError::DatabaseHole) or similar error return.

Additional Attack Vectors

  • Deep reorg DoS: A miner with significant hash power (or a compromised validator) triggers a deep reorg. Zaino spends excessive CPU and memory in handle reorg, starving the async runtime and stalling response serving.
  • Fork-choice manipulation: By serving cyclic or very deep sidechains, an attacker can keep Zaino stuck in reorg handling indefinitely, preventing it from ever serving the real best chain.

Fix

Allocation of Resources Without Limits

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-770

Related Identifiers

GHSA-3WHF-VGF2-9W6G

Affected Products

Zaino-State