Executive brief
The bsv-sdk library, used for interacting with the BSV blockchain, contains a flaw in how it handles transaction broadcasts. It incorrectly reports certain failed transaction attempts (such as invalid or malformed transactions) as successful. This can trick applications into releasing goods or services for payments that were never actually accepted by the network.
Technical details
The vulnerability exists in `lib/bsv/network/arc.rb` due to an incomplete failure predicate. The implementation only recognizes `REJECTED` and `DOUBLE_SPEND_ATTEMPTED` as error states, while ignoring other standard ARC failure statuses like `INVALID`, `MALFORMED`, and `MINED_IN_STALE_BLOCK`. An attacker or a naturally occurring network condition can trigger these statuses, causing the SDK to return a success response to the caller. This allows for 'ghost' transactions where an application logic proceeds as if a transaction is valid and broadcasted when it has actually been rejected by the ARC endpoint. The issue is resolved in version 0.8.2 by expanding the failure detection logic.
Affected products
- sgbett bsv-sdk >= 0.1.0, < 0.8.2
Timeline
- 2026-02-08: other: Vulnerability introduced in commit a1f2e62
- 2026-04-08: disclosed: Identified during cross-SDK compliance review
- 2026-04-09: advisory: GitHub Advisory published