Executive brief
Lodestar is an Ethereum client library used for beacon chain validation and network communication. The vulnerability allows attackers to send malformed compressed messages with invalid checksums that the client accepts, potentially causing network consensus failures and requiring a hard fork if exploited at scale.
Technical details
Lodestar's snappy frame decoder fails to verify checksums on uncompressed data chunks in the Req/Resp protocol encoding. While the Go snappy implementation correctly validates CRC32 checksums and rejects corrupted frames, Lodestar unconditionally appends uncompressed chunk data without checksum validation. An attacker can craft malicious messages with invalid checksums that Lodestar will process, while compliant implementations reject them. This creates a protocol divergence. The vulnerability requires network access and occurs in the message deserialization path. The impact statement indicates potential for a network-wide chain split affecting ≥25% of nodes if exploited broadly.
Affected products
- ChainSafe Lodestar < 1.25.0
Timeline
- 2025-01-14: disclosed
- 2025-01-08: patched: Commit 18a0d68 added checksum validation via crc32c import