ZingoLabs zaino-state denial of service in reorg handling

Executive brief

ZingoLabs zaino-state, a component used for tracking blockchain state, is vulnerable to a denial-of-service attack. A malicious or malfunctioning validator can provide specially crafted block data that causes the system to enter an infinite loop or crash. This results in 100% CPU usage, prevents the system from synchronizing with the network, and stops it from serving data to clients.

Technical details

The vulnerability exists in the `NonFinalizedState::handle_reorg` function within `packages/zaino-state/src/chain_index/non_finalised_state.rs`. The function performs recursive, unbounded async calls to traverse parent blocks without a depth limit or cycle detection. An attacker (compromised validator) can serve a block where the `previous_block_hash` points to itself or forms a cycle, triggering an infinite loop that consumes 100% CPU and heap memory. Additionally, the `update()` function contains an `.expect()` call that can trigger a panic if a snapshot becomes empty after trimming finalized blocks. These issues are resolved in version 0.4.1 by adding recursion limits, cycle detection, and proper error handling.

Affected products

• ZingoLabs zaino-state < 0.4.1

Timeline

• disclosed: Reported by ouicate
• 2026-07-31: advisory
• 2026-07-31: patched: Fixed in version 0.4.1

References

• https://api.github.com/users/ouicate
• https://github.com/ouicate
• https://api.github.com/users/ouicate/gists%7B/gist_id%7D
• https://api.github.com/users/ouicate/repos
• https://avatars.githubusercontent.com/u/250333441?v=4
• https://api.github.com/users/ouicate/events%7B/privacy%7D