Executive brief
Signum Node is a cryptocurrency blockchain system that processes mining rewards and transaction fees. An integer overflow bug in the fee calculation logic allowed a miner to craft a malicious block that inflates their reward by an arbitrary amount, corrupting the ledger and potentially splitting the blockchain network. This vulnerability was actively exploited on the live network and required immediate emergency patches to prevent further damage.
Technical details
An integer overflow vulnerability exists in BlockServiceImpl.applyBlock() where fee arithmetic performed unchecked long integer subtraction: rewardFeesNqt -= block.getTotalFeeCashBackNqt(). A miner can craft a block with totalFeeCashBackNqt set to the minimum long value (-4,611,686,018,427,387,903), causing integer wraparound that results in an enormously large positive reward credited directly to the miner's account. The vulnerability was introduced in the SMART_FEES hardfork (block ~1,029,000) which enabled fee cash-back accounting without overflow protection. No authentication or privileges are required; any miner can exploit this by crafting a valid proof-of-work block. The fix (v3.9.8+) replaced all fee arithmetic with safe arithmetic functions and added explicit validation to reject blocks with negative fee values.
Affected products
- Signum Network Signum Node 3.9.0 through 3.9.7 (when SMART_FEES hardfork is active)
Timeline
- 2026-06-01: disclosed: GitHub security advisory published
- 2026-05-21: patched: Version 3.9.9 released with complete fix
- 2026-block: exploited: Actively exploited on mainnet; account 9418715215596353226 created malicious block
- 2026-09-03: advisory: CVE-2026-48486 published