Description

Zebra before 6.3.0 contains an improper exceptional condition check in ChainSync::obtain_tips that discards valid one-hash FindBlocks responses, falsely reporting close-to-tip status. Peers returning only the next block hash cause a zero-length sync sample, making the /ready endpoint return 200 OK while the node remains behind the tip.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-10-02T12:17:13.763Z",
  "pubdate": "2026-10-02T12:17:13.763Z",
  "executiveSummary": "The vulnerability resides in the ChainSync::obtain_tips function of the Zebra node software, specifically versions prior to 6.3.0.\nThis flaw manifests as an improper exceptional condition check that incorrectly handles specific FindBlocks responses, leading to an inaccurate representation of the node's synchronization status.\nBy returning only the next block hash, a malicious or malformed peer can trigger a zero-length sync sample, causing the node to falsely report a synchronized state via the /ready endpoint despite being significantly behind the network tip.\nThe impact is a denial-of-service condition regarding synchronization reliability, as the node erroneously signals readiness to participate in network operations while failing to maintain an accurate view of the blockchain state.\nThis exploitation does not require authentication or elevated privileges, as it leverages the standard peer-to-peer communication protocol.\nThe primary risk is the degradation of network integrity and the potential for a node to misinform downstream services or users about the current state of the ledger, potentially leading to incorrect data consumption or transaction processing errors based on a non-current chain head.",
  "technicalDetails": "The vulnerability is localized within the ChainSync::obtain_tips function, which is responsible for reconciling the local block chain head with the information provided by remote peers during the synchronization process.\nThe root cause is an inadequate exceptional condition check during the parsing of FindBlocks responses. When a peer responds with only a single block hash—the 'next' expected block—the logic incorrectly identifies this as a valid synchronization termination or completion signal.\nSpecifically, the code fails to validate the length of the sync sample returned by the peer. In a scenario where the peer returns a single-hash response, the internal logic generates a zero-length sync sample. Due to the flawed conditional check, this zero-length sample is incorrectly processed as a successful synchronization state rather than an incomplete or ambiguous response.\nConsequently, the node's internal state machine updates the synchronization status to a 'synced' or 'close-to-tip' condition prematurely. This state is then exposed through the /ready health-check endpoint, which returns an HTTP 200 OK status.\nThe attack flow proceeds as follows: 1) An attacker connects to a Zebra node as a peer. 2) The attacker intercepts or waits for a FindBlocks request from the Zebra node. 3) The attacker crafts a malicious response containing only the next sequential block hash. 4) The Zebra node's ChainSync::obtain_tips function processes this response, fails to validate the brevity of the payload, and triggers an erroneous state transition. 5) The Zebra node updates its readiness status to true, despite failing to actually synchronize the remainder of the chain.\nThis vulnerability is particularly insidious because it involves no authentication, as the peer-to-peer protocol expects open interaction between nodes. The network exposure is broad, as any node capable of communicating with a Zebra peer can potentially induce this failure state. Post-exploitation, the node remains in a state of 'functional deception,' where it believes it is at the chain tip, effectively halting further synchronization progress for the duration of the state cache validity. This prevents the node from correctly validating incoming transactions or blocks, as it lacks the necessary context of the true blockchain head, potentially leading to chain forks or rejected valid transactions."
}