Executive brief
The BSV Blockchain SDK's TypeScript implementation contains a cryptographic flaw in its BRC-104 authentication protocol that causes it to generate incorrect digital signatures when authenticating peers. This breaks compatibility with other SDK implementations (Go, Python) and could allow attackers to bypass authentication checks, enabling unauthorized access or man-in-the-middle attacks on peer-to-peer communication channels.
Technical details
The vulnerability stems from incorrect base64 decoding in the Peer.ts file (lines 527-531 for signing, 584-590 for verification). The SDK concatenates two base64-encoded nonce strings before decoding, which causes the base64 decoder to stop at the first padding character ('='), producing only ~32-34 bytes instead of the expected 64 bytes. The correct approach is to decode each nonce individually, then concatenate the resulting byte arrays. This vulnerability is a cryptographic signature verification bypass (CWE-573) that allows TypeScript SDK clients to fail authentication with Go/Python servers due to signature mismatch, or potentially bypass signature verification entirely. The fix was released in version 2.0.0.
Affected products
- BSV Blockchain SDK <2.0.0
Timeline
- 2026-02-17: disclosed
- 2026-02-17: patched: Fixed in version 2.0.0