art_of_bug | Publish0x
art_of_bug
art_of_bug

art_of_bug

We are research group with focus to expose bugs in design and implementation of blockchain projects. We only honour responsible disclosure with projects that honour responsible development.


Neblio – Orphans Memory Leak

1 week ago 4 minute read art_of_bug $1.64 tipped

Welcome again. This is probably the last time we write about Neblio. We could create new and new reports because its code is incredibly buggy, but it makes no sense given the attitude of the Neblio development team. So, just to prove the point, here...

Qtum (fixed) & NavCoin (not fixed) – Direct Block Propagation mapBlockIndex DoS

26 Dec 2019 8 minute read art_of_bug $1.93 tipped

Welcome to the next episode. In September we have published NavCoin – Bypassing Header Spam Protection, which was a denial of service attack against the header spam filter in NavCoin. As far as we know, this issue has not been fixed in NavCoin yet. A...

Syscoin – Invalid Middle Block In Sysethereum Superblock

27 Nov 2019 7 minute read art_of_bug $1.18 tipped

Welcome back. Today we are back to Syscoin. Previously we have published two submissions to the bounty related to the implementation of the  Sysethereum bridge. Today we present another vulnerability that we found later in the Sysethereum bridge impl...

Neblio – Instant Node Crash Using VerifyInputsUnspent

31 Oct 2019 5 minute read art_of_bug $1.25 tipped

Welcome back. Last time we explained how Neblio's attempt to fix the DoS vulnerability we reported many months ago did not actually work and that it only addressed our specific exploit implementation. We explained how to perform this attack against t...

Neblio – VerifyInputsUnspent Still Not Fixed

13 Oct 2019 4 minute read art_of_bug $1.17 tipped

Welcome. Remember our very first post?  Recall that we didn't like the way Neblio team (not)communicated. We published a vulnerability in their code and waited for the reaction. At first it seemed like they acknowledged the problem with poor communic...

Qtum – setStakeSeen Mistake

29 Sep 2019 7 minute read art_of_bug $2.80 tipped

Welcome back. Today we open Qtum. We started to participate in Qtum's bug bounty program many months ago and we already submitted several findings there, all of which have been accepted. Today we present one of the vulnerabilities that have been fixe...

NavCoin – Bypassing Header Spam Protection

14 Sep 2019 6 minute read art_of_bug $1.94 tipped

Welcome back. Today we will talk about NavCoin. We start with a little rant as we sometimes do when we feel things could have gone better. Then we disclose an unpatched vulnerability in NavCoin Core which was caused by copying and pasting the code fr...

Syscoin Hack Ethereum Bridge Bounty 2 - Superblocks Future Time Bug

28 Aug 2019 4 minute read art_of_bug $0.91 tipped

Nice to see you again. Last time we have described our first submission to the hack the Syscoin's Ethereum bridge bounty (do follow this link also to find information about Syscoin Ethereum bridge, some understanding of it is useful to be able to gra...

Syscoin Hack Ethereum Bridge Bounty - The Cut Off Problem

14 Aug 2019 16 minute read art_of_bug $1.50 tipped

Welcome back. Hacking production chains a.k.a. mainnets is the most fun, but when incentives allow, exploring testnets can be fun too. The following is our first submission to the hack the Syscoin's Ethereum bridge bounty (do follow this link also to...

Emercoin – Bypassing POS Temperature

28 Jul 2019 8 minute read art_of_bug $0.58 tipped

Welcome to the next episode. Last time we discussed Emercoin's 51% attack and the related hardfork. We mentioned that there were more vulnerabilities we have discussed with Emercoin's team. Today we present one of the issues that we reported. It has...