Executive brief
The bsv-sdk and bsv-wallet libraries, used for interacting with the BSV blockchain, fail to verify digital signatures when acquiring identity certificates. This allows an attacker to forge credentials—such as identity claims or age attestations—that the system will treat as authentic. This could lead to unauthorized access or the acceptance of fraudulent identity data in applications relying on these wallets.
Technical details
A signature verification bypass exists in the `BSV::Wallet::WalletClient#acquire_certificate` method within `wallet_client.rb`. The implementation fails to validate the `signature` field against the certifier's public key for both 'direct' and 'issuance' acquisition protocols. In the direct path, caller-supplied fields are stored verbatim; in the issuance path, the client trusts the response from a certifier URL without verification. This allows an attacker to inject forged BRC-52 certificates into the wallet's storage, which are subsequently trusted by `list_certificates` and `prove_certificate`. The issue is resolved in bsv-sdk 0.8.2 and bsv-wallet 0.3.4 by implementing mandatory BRC-52 canonical preimage verification.
Affected products
- sgbett bsv-sdk >= 0.3.1, < 0.8.2
- sgbett bsv-wallet >= 0.1.2, < 0.3.4
Timeline
- 2026-03-27: other: Vulnerable direct-path code introduced
- 2026-03-28: other: Vulnerable issuance-path code introduced
- 2026-04-08: disclosed: Identified during cross-SDK compliance review
- 2026-04-09: advisory