security-research-notebook/qbft-hasbadproposal-consensus-stall/index.html

473 lines · html
<!doctype html>
<html lang="en"><head><meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>QBFT HasBadProposal Quorum Inconsistency, Consensus Liveness Violation | Zion Boggan</title>
<meta name="description" content="QBFT&amp;#x27;s `HasBadProposal` check is symmetric across the round, one prepared bad proposal halts the round for every validator.">
<link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect width='32' height='32' rx='6' fill='%230c0e12'/%3E%3Ctext x='16' y='22' font-family='monospace' font-size='15' fill='%236cc7b8' text-anchor='middle'%3Ezb%3C/text%3E%3C/svg%3E">
<style>
  :root{
    --bg:#0c0e12; --bg2:#0f1217; --panel:#14181f; --panel2:#171c24;
    --line:#222936; --line2:#2c3543;
    --ink:#e8eaed; --soft:#c3cad4; --muted:#8a94a3; --faint:#5d6675;
    --accent:#6cc7b8; --accent-dim:#274b47;
    --maxw:1020px;
  }
  *{box-sizing:border-box;}
  html{scroll-behavior:smooth;}
  body{margin:0;background:var(--bg);color:var(--ink);
    font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;
    font-size:16px;line-height:1.65;-webkit-font-smoothing:antialiased;}
  .mono{font-family:ui-monospace,SFMono-Regular,"SF Mono",Menlo,Consolas,monospace;}
  a{color:var(--accent);text-decoration:none;}
  a:hover{color:#8fe0d2;}
  .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px;}
 
  /* nav */
  nav{position:sticky;top:0;z-index:20;background:rgba(12,14,18,.82);
    backdrop-filter:blur(10px);border-bottom:1px solid var(--line);}
  nav .wrap{display:flex;align-items:center;justify-content:space-between;height:58px;}
  nav .brand{font-weight:600;letter-spacing:.2px;}
  nav .brand .dot{color:var(--accent);}
  nav .links{display:flex;gap:26px;font-size:13.5px;}
  nav .links a{color:var(--muted);}
  nav .links a:hover{color:var(--ink);}
  @media(max-width:680px){nav .links{display:none;}}
 
  /* hero */
  header.hero{padding:74px 0 54px;border-bottom:1px solid var(--line);
    background:radial-gradient(900px 380px at 78% -10%, #11201e 0%, transparent 60%);}
  .avail{font-size:12.5px;letter-spacing:1.5px;text-transform:uppercase;color:var(--accent);
    display:flex;align-items:center;gap:9px;margin-bottom:20px;}
  .avail .pulse{width:7px;height:7px;border-radius:50%;background:var(--accent);
    box-shadow:0 0 0 0 rgba(108,199,184,.5);animation:p 2.4s infinite;}
  @keyframes p{0%{box-shadow:0 0 0 0 rgba(108,199,184,.45)}70%{box-shadow:0 0 0 8px rgba(108,199,184,0)}100%{box-shadow:0 0 0 0 rgba(108,199,184,0)}}
  h1{font-size:clamp(34px,6vw,52px);line-height:1.05;margin:0 0 8px;letter-spacing:-1px;font-weight:680;}
  .hero .sub{font-size:clamp(16px,2.4vw,20px);color:var(--soft);margin:0 0 24px;font-weight:500;}
  .hero .lede{max-width:660px;color:var(--soft);font-size:17px;margin:0 0 28px;}
  .hero .lede b{color:var(--ink);font-weight:600;}
  .cta{display:flex;flex-wrap:wrap;gap:12px;align-items:center;}
  .btn{display:inline-flex;align-items:center;gap:8px;padding:10px 18px;border-radius:8px;
    font-size:14.5px;font-weight:550;border:1px solid var(--line2);color:var(--ink);background:var(--panel);}
  .btn:hover{border-color:var(--accent-dim);background:var(--panel2);color:var(--ink);}
  .btn.primary{background:var(--accent);color:#06231f;border-color:var(--accent);font-weight:650;}
  .btn.primary:hover{background:#8fe0d2;color:#06231f;}
  .meta{margin-top:26px;display:flex;flex-wrap:wrap;gap:8px 22px;font-size:13px;color:var(--muted);}
  .meta .mono{color:var(--faint);}
 
  /* sections */
  section{padding:64px 0;border-bottom:1px solid var(--line);}
  .shead{display:flex;align-items:baseline;gap:14px;margin-bottom:30px;}
  .shead .idx{font-size:13px;color:var(--accent);letter-spacing:1px;}
  .shead h2{font-size:14px;letter-spacing:2px;text-transform:uppercase;color:var(--muted);margin:0;font-weight:600;}
  .shead .rule{flex:1;height:1px;background:var(--line);}
 
  /* flagship */
  .flag{background:linear-gradient(180deg,var(--panel) 0%,var(--bg2) 100%);
    border:1px solid var(--line2);border-radius:14px;overflow:hidden;}
  .flag .top{padding:30px 32px 8px;}
  .flag .tag{font-size:12px;letter-spacing:1.5px;text-transform:uppercase;color:var(--accent);margin-bottom:12px;}
  .flag h3{font-size:27px;margin:0 0 6px;letter-spacing:-.4px;}
  .flag h3 .v{font-size:13px;color:var(--muted);font-weight:500;margin-left:8px;letter-spacing:0;}
  .flag .grid{display:grid;grid-template-columns:1.25fr 1fr;gap:30px;padding:14px 32px 30px;}
  .flag p{color:var(--soft);margin:0 0 16px;}
  .flag .stats{display:grid;grid-template-columns:1fr 1fr;gap:12px;margin-top:6px;}
  .stat{background:var(--bg);border:1px solid var(--line);border-radius:9px;padding:13px 15px;}
  .stat .n{font-size:21px;font-weight:680;color:var(--ink);}
  .stat .k{font-size:12px;color:var(--muted);margin-top:2px;}
  .spec{background:var(--bg);border:1px solid var(--line);border-radius:10px;padding:18px 18px;}
  .spec .sk{font-size:11px;letter-spacing:1.5px;text-transform:uppercase;color:var(--faint);margin-bottom:10px;}
  .spec ul{margin:0;padding:0;list-style:none;font-size:13.5px;}
  .spec li{padding:6px 0;border-top:1px solid var(--line);color:var(--soft);display:flex;justify-content:space-between;gap:14px;}
  .spec li:first-child{border-top:none;}
  .spec li span{color:var(--muted);}
  .flag .foot{padding:0 32px 28px;display:flex;gap:18px;flex-wrap:wrap;font-size:14px;}
  @media(max-width:720px){.flag .grid{grid-template-columns:1fr;}}
 
  /* lab cards */
  .cards{display:grid;grid-template-columns:1fr 1fr;gap:20px;}
  @media(max-width:680px){.cards{grid-template-columns:1fr;}}
  .card{border:1px solid var(--line);border-radius:12px;overflow:hidden;background:var(--panel);
    display:flex;flex-direction:column;transition:border-color .15s,transform .15s;}
  .card:hover{border-color:var(--accent-dim);transform:translateY(-2px);}
  .card .thumb{height:172px;overflow:hidden;border-bottom:1px solid var(--line);background:#fff;}
  .card .thumb img{width:100%;height:100%;object-fit:cover;object-position:top left;display:block;}
  .card .body{padding:18px 20px 20px;display:flex;flex-direction:column;flex:1;}
  .card h3{margin:0 0 9px;font-size:17px;}
  .card p{margin:0 0 14px;font-size:14px;color:var(--soft);flex:1;}
  .tags{display:flex;flex-wrap:wrap;gap:6px;margin-bottom:14px;}
  .tags span{font-size:11.5px;color:var(--muted);background:var(--bg);border:1px solid var(--line);
    border-radius:5px;padding:3px 8px;}
  .card .lnk{font-size:13.5px;font-family:ui-monospace,Menlo,monospace;}
  .card .lnk::after{content:" →";}
 
  /* research */
  .rlede{color:var(--soft);max-width:680px;margin:-6px 0 26px;}
  .research{display:flex;flex-direction:column;gap:0;border:1px solid var(--line);border-radius:12px;overflow:hidden;}
  .ritem{display:grid;grid-template-columns:120px 1fr auto;gap:18px;align-items:center;
    padding:18px 22px;border-top:1px solid var(--line);}
  .ritem:first-child{border-top:none;}
  .ritem:hover{background:var(--panel);}
  .ritem .cls{font-size:11px;letter-spacing:.5px;text-transform:uppercase;color:var(--accent);}
  .ritem h3{margin:0 0 3px;font-size:16px;}
  .ritem p{margin:0;font-size:13.5px;color:var(--muted);}
  .ritem .go{font-family:ui-monospace,Menlo,monospace;font-size:13px;white-space:nowrap;}
  @media(max-width:680px){.ritem{grid-template-columns:1fr;gap:6px;}.ritem .go{margin-top:4px;}}
  .progs{margin-top:22px;}
  .progs .sk{font-size:11px;letter-spacing:1.5px;text-transform:uppercase;color:var(--faint);margin-bottom:11px;}
  .progs .row{display:flex;flex-wrap:wrap;gap:7px;}
  .progs .row span{font-size:12.5px;color:var(--soft);background:var(--panel);border:1px solid var(--line);
    border-radius:6px;padding:4px 10px;}
 
  /* credentials */
  .cred{display:grid;grid-template-columns:1.1fr 1fr;gap:28px;}
  @media(max-width:680px){.cred{grid-template-columns:1fr;}}
  .cred p{color:var(--soft);margin:0 0 14px;}
  .cred .role{font-size:14px;color:var(--muted);}
  .cred .role b{color:var(--ink);font-weight:600;}
  .certs{list-style:none;margin:0;padding:0;}
  .certs li{padding:9px 0;border-top:1px solid var(--line);font-size:14px;color:var(--soft);
    display:flex;gap:10px;align-items:baseline;}
  .certs li:first-child{border-top:none;}
  .certs li .c{color:var(--accent);font-family:ui-monospace,Menlo,monospace;font-size:12px;}
 
  footer{padding:46px 0 64px;}
  footer .row{display:flex;flex-wrap:wrap;justify-content:space-between;gap:18px;align-items:center;}
  footer .links a{color:var(--soft);margin-right:20px;font-size:14px;}
  footer .note{color:var(--faint);font-size:12.5px;max-width:520px;}
 
  .detail-hero{padding:40px 0 26px;}
  .back{display:inline-block;font-size:13px;color:var(--muted);margin-bottom:20px;font-family:ui-monospace,Menlo,monospace;}
  .back:hover{color:var(--ink);}
  .kicker{font-size:12px;letter-spacing:2px;text-transform:uppercase;color:var(--accent);margin-bottom:13px;font-family:ui-monospace,Menlo,monospace;}
  .detail-hero h1{font-size:clamp(26px,4.6vw,38px);margin:0 0 12px;letter-spacing:-.5px;}
  .detail-hero .tagline{font-size:clamp(15px,2vw,18px);color:var(--soft);max-width:800px;margin:0 0 16px;}
  .facts{display:grid;grid-template-columns:repeat(auto-fit,minmax(150px,1fr));gap:12px;margin-top:22px;}
  .content{padding:8px 0 0;max-width:840px;}
  .content h1{font-size:24px;margin:40px 0 14px;letter-spacing:-.4px;color:var(--ink);}
  .content h2{font-size:13px;letter-spacing:2px;text-transform:uppercase;color:var(--muted);margin:42px 0 15px;font-weight:600;border-top:1px solid var(--line);padding-top:28px;}
  .content h3{font-size:17px;margin:28px 0 10px;color:var(--ink);font-weight:600;}
  .content h4{font-size:14px;margin:22px 0 8px;color:var(--soft);font-weight:600;text-transform:uppercase;letter-spacing:.5px;}
  .content p{color:var(--soft);margin:0 0 15px;}
  .content ul,.content ol{color:var(--soft);margin:0 0 15px;padding-left:22px;}
  .content li{margin:5px 0;}
  .content strong{color:var(--ink);font-weight:600;}
  .content a{color:var(--accent);}
  .content code{font-family:ui-monospace,Menlo,monospace;font-size:12.8px;background:var(--panel2);border:1px solid var(--line);border-radius:4px;padding:1px 5px;color:var(--soft);}
  .content pre{background:var(--bg2);border:1px solid var(--line2);border-radius:10px;padding:15px 18px;overflow-x:auto;margin:0 0 18px;}
  .content pre code{background:none;border:none;padding:0;font-size:12.4px;color:var(--soft);line-height:1.6;white-space:pre;}
  .content table{width:100%;border-collapse:collapse;margin:2px 0 20px;font-size:13.3px;}
  .content th{text-align:left;color:var(--muted);font-weight:600;border-bottom:1px solid var(--line2);padding:9px 12px;font-size:11px;letter-spacing:.6px;text-transform:uppercase;}
  .content td{color:var(--soft);border-bottom:1px solid var(--line);padding:9px 12px;vertical-align:top;}
  .content blockquote{border-left:3px solid var(--accent-dim);margin:0 0 16px;padding:2px 0 2px 18px;color:var(--muted);}
  .content hr{border:none;border-top:1px solid var(--line);margin:30px 0;}
  /* notebook index */
  .nbgroup{margin:40px 0 0;}
  .nbgroup h2{font-size:13px;letter-spacing:2px;text-transform:uppercase;color:var(--accent);margin:0 0 4px;font-weight:600;}
  .nbgroup .gd{color:var(--faint);font-size:13px;margin:0 0 14px;}
  .nbtable{width:100%;border-collapse:collapse;font-size:14px;border:1px solid var(--line);border-radius:12px;overflow:hidden;}
  .nbtable tr{border-top:1px solid var(--line);}
  .nbtable tr:first-child{border-top:none;}
  .nbtable tr:hover{background:var(--panel);}
  .nbtable td{padding:14px 16px;vertical-align:top;}
  .nbtable .cls{white-space:nowrap;color:var(--accent);font-family:ui-monospace,Menlo,monospace;font-size:11.5px;text-transform:uppercase;letter-spacing:.5px;width:150px;}
  .nbtable .ti a{font-weight:600;color:var(--ink);}
  .nbtable .ti a:hover{color:var(--accent);}
  .nbtable .ol{color:var(--muted);font-size:13px;margin-top:3px;}
  @media(max-width:680px){.nbtable .cls{width:auto;display:block;}}
</style>
<link rel="canonical" href="https://zionboggan.com/security-research-notebook/qbft-hasbadproposal-consensus-stall/">
<meta name="author" content="Zion Boggan">
<meta name="robots" content="index, follow, max-image-preview:large">
<meta property="og:type" content="article">
<meta property="og:site_name" content="Zion Boggan">
<meta property="og:title" content="QBFT HasBadProposal Quorum Inconsistency - Consensus Liveness Violation | Zion Boggan">
<meta property="og:description" content="QBFT&amp;#x27;s `HasBadProposal` check is symmetric across the round, one prepared bad proposal halts the round for every validator.">
<meta property="og:url" content="https://zionboggan.com/security-research-notebook/qbft-hasbadproposal-consensus-stall/">
<meta property="og:image" content="https://zionboggan.com/assets/og-default.png">
<meta name="twitter:card" content="summary_large_image">
<meta name="twitter:title" content="QBFT HasBadProposal Quorum Inconsistency - Consensus Liveness Violation | Zion Boggan">
<meta name="twitter:description" content="QBFT&amp;#x27;s `HasBadProposal` check is symmetric across the round, one prepared bad proposal halts the round for every validator.">
<meta name="twitter:image" content="https://zionboggan.com/assets/og-default.png">
<script type="application/ld+json">{"@context":"https://schema.org","@type":"TechArticle","headline":"QBFT HasBadProposal Quorum Inconsistency - Consensus Liveness Violation","description":"QBFT&amp;#x27;s `HasBadProposal` check is symmetric across the round, one prepared bad proposal halts the round for every validator.","url":"https://zionboggan.com/security-research-notebook/qbft-hasbadproposal-consensus-stall/","image":"https://zionboggan.com/assets/og-default.png","author":{"@type":"Person","name":"Zion Boggan","url":"https://zionboggan.com"},"publisher":{"@type":"Person","name":"Zion Boggan"}}</script>
</head><body>
<nav><div class="wrap">
  <a class="brand mono" href="/" style="color:var(--ink)">zion_boggan<span class="dot">.</span></a>
  <span class="links"><a href="/#oversight">Oversight</a><a href="/#labs">Labs</a><a href="/#research">Research</a><a href="/security-research-notebook/">Notebook</a><a href="/">Home</a></span>
</div></nav>
<header class="hero detail-hero"><div class="wrap">
  <a class="back" href="/security-research-notebook/">&larr; Research notebook</a>
  <div class="kicker">Consensus stall</div>
  <h1>QBFT HasBadProposal Quorum Inconsistency, Consensus Liveness Violation</h1>
</div></header>
<section><div class="wrap"><div class="content">
<h2>Severity: P1 (Criteria B: &ldquo;shutting down/disrupting block production&rdquo;)</h2>
<hr />
<h2>Summary</h2>
<p>A single Byzantine validator can permanently stall block production on the Electroneum
Smart Chain by exploiting an inconsistency between how <code>roundChangeSet.Add()</code> and
<code>isJustified()</code> handle the <code>HasBadProposal</code> flag. The former accepts a SINGLE message&rsquo;s
flag, while the latter requires a QUORUM. This allows a single malicious validator to
poison the proposer&rsquo;s prepared-block cache, causing every subsequent proposal to fail
justification validation, resulting in an indefinite consensus stall.</p>
<p>This violates IBFT/QBFT&rsquo;s fundamental liveness guarantee: the protocol should maintain
liveness with up to f = floor((n-1)/3) Byzantine validators.</p>
<hr />
<h2>Root Cause</h2>
<h3>The Inconsistency</h3>
<p><strong>File: <code>consensus/istanbul/core/justification.go</code></strong></p>
<p>The <code>isJustified()</code> function (called before broadcasting a PRE-PREPARE) computes
<code>hasBadProposal</code> from a QUORUM count:</p>
<pre><code class="language-go">// justification.go - lines 37-51
hasBadProposalCount := 0
for _, rcm := range roundChangeMessages {
    if rcm.HasBadProposal {
        // ... dedup by source
        hasBadProposalCount++
    }
}
hasBadProposal := hasBadProposalCount &gt;= uint(quorumSize)  // REQUIRES QUORUM
</code></pre>
<p>But <code>roundChangeSet.Add()</code> (called when each ROUND-CHANGE message arrives) uses the
SINGLE message&rsquo;s <code>HasBadProposal</code> flag:</p>
<pre><code class="language-go">// roundchange.go - roundChangeSet.Add()
roundChange := msg.(*qbfttypes.RoundChange)
if hasMatchingRoundChangeAndPrepares(roundChange, prepareMessages, quorumSize,
    roundChange.HasBadProposal,  // &lt;-- SINGLE MESSAGE'S FLAG, NOT QUORUM
    rcs.validatorSet) == nil {
    rcs.highestPreparedRound[round] = preparedRound
    rcs.highestPreparedBlock[round] = preparedBlock  // POISONED
    rcs.prepareMessages[round] = prepareMessages
}
</code></pre>
<h3>What <code>HasBadProposal=true</code> Bypasses</h3>
<p>In <code>hasMatchingRoundChangeAndPrepares()</code> (justification.go, lines 175-182):</p>
<pre><code class="language-go">for _, p := range prepareMessages {
    if p.Digest != roundChange.PreparedDigest &amp;&amp; !hasBadProposal {
        return errors.New(&quot;prepared message digest does not match...&quot;)
    }
}
</code></pre>
<p>When <code>hasBadProposal=true</code>, PREPARE messages for block A are accepted as justification
for a ROUND-CHANGE claiming block B was prepared. The round check still applies (PREPARE
round must match RC&rsquo;s PreparedRound), but the digest/block mismatch is ignored.</p>
<hr />
<h2>Exploit Chain</h2>
<h3>Prerequisites</h3>
<ul>
<li>Attacker controls ONE validator key (within IBFT&rsquo;s Byzantine tolerance)</li>
<li>Normal block production is occurring</li>
</ul>
<h3>Step-by-Step</h3>
<p><strong>Phase 1, Capture PREPARE Messages</strong></p>
<ol>
<li>Sequence S, Round 0: The proposer proposes block A.</li>
<li>Validators reach the PREPARED state, they broadcast PREPARE messages for
   (sequence=S, round=0, digest=hash(A)).</li>
<li>The attacker (a validator) captures these PREPARE messages from the P2P gossip.
   These messages are signed by legitimate validators and are freely available to any peer.</li>
<li>If COMMIT quorum is NOT reached (timeout, network delay, or attacker withholds their
   COMMIT), a round change begins.</li>
</ol>
<p><strong>Phase 2, Poison the Round Change Set</strong></p>
<ol start="5">
<li>For round 1, the attacker crafts a ROUND-CHANGE message:
   <code>Round:          1
   PreparedRound:  0        (matches the captured PREPAREs)
   PreparedBlock:  block B  (ATTACKER'S ARBITRARY BLOCK)
   PreparedDigest: hash(B)  (does NOT match the PREPAREs' digest)
   HasBadProposal: true     (bypasses digest check in Add())
   Justification:  [captured PREPARE messages for block A, round 0]</code></li>
<li>
<p>The attacker signs this RC with their validator key and broadcasts it.</p>
</li>
<li>
<p>When any validator processes this RC in <code>handleRoundChange()</code>, it calls
   <code>roundChangeSet.Add()</code>:, <code>preparedRound(0) != nil</code> → enters the block, <code>highestPreparedRound[1] == nil</code> → condition met, <code>hasMatchingRoundChangeAndPrepares(rc, prepares, quorum, true, valSet)</code>:</p>
<ul>
<li>PREPARE.Round(0) == RC.PreparedRound(0) → PASS</li>
<li>PREPARE.Digest(hash(A)) != RC.PreparedDigest(hash(B)) &amp;&amp; !true → PASS (bypassed)</li>
<li>Quorum of distinct validator signatures → PASS</li>
<li><strong>Result: <code>highestPreparedBlock[1] = block B</code> (POISONED)</strong></li>
</ul>
</li>
</ol>
<p><strong>Phase 3, Consensus Stall</strong></p>
<ol start="8">
<li>
<p>Legitimate validators also send their RCs for round 1 (with preparedRound=nil,
   since they didn&rsquo;t complete a prepare phase after round 0&rsquo;s stall, or with
   preparedRound=0 and the correct block A).</p>
</li>
<li>
<p>If a legitimate RC has preparedRound=0 and correct block A, it would try to set
   highestPreparedBlock. But:, <code>preparedRound(0).Cmp(highestPreparedRound[1](0)) &gt; 0</code> → FALSE (0 is NOT &gt; 0), The legitimate entry does NOT overwrite the poisoned one.</p>
</li>
<li>
<p>When quorum of RCs is reached for round 1, and the proposer for round 1 executes:
    ```go
    // roundchange.go, handleRoundChange()
    _, proposal := c.highestPrepared(currentRound)  // Returns block B (poisoned)
    // HasBadProposal(hash(B)) returns false (block B is unknown)
    // proposal = block B</p>
<p>// isJustified(blockB, rcPayloads, preparesForBlockA, quorum, valSet)
// In isJustified: hasBadProposalCount &lt; quorum (only 1 RC has flag)
// Digest check: hash(B) != PREPARE.digest(hash(A)) &amp;&amp; !false → FAILS
// Result: &ldquo;prepared messages do not match proposal&rdquo; error
```</p>
</li>
<li>
<p>The proposal is BLOCKED. No block is proposed for round 1. Round times out.</p>
</li>
</ol>
<p><strong>Phase 4, Persistent Stall</strong></p>
<ol start="12">
<li>
<p><code>startNewRound(2)</code> is called. <code>ClearLowerThan(2)</code> clears rounds 0 and 1.
    Round 2 starts fresh.</p>
</li>
<li>
<p>The attacker re-sends a poisoned RC for round 2:</p>
<ul>
<li>Same captured PREPAREs from round 0 (they&rsquo;re still valid)</li>
<li>PreparedRound=0, PreparedBlock=C (another arbitrary block), HasBadProposal=true</li>
</ul>
</li>
<li>
<p>In <code>roundChangeSet.Add()</code> for round 2:</p>
<ul>
<li><code>highestPreparedRound[2] == nil</code> → condition met</li>
<li>poisoning succeeds again</li>
</ul>
</li>
<li>
<p>This repeats indefinitely. The attacker can stall EVERY round at this sequence
    using the SAME captured PREPARE messages from the original round 0.</p>
</li>
<li>
<p>Since no block is ever committed, the sequence never advances, and the
    roundChangeSet is never fully reset (only <code>round == 0</code> triggers <code>newRoundChangeSet</code>).</p>
</li>
</ol>
<hr />
<h2>Impact</h2>
<ul>
<li><strong>Permanent consensus stall</strong>: Block production halts indefinitely at a specific
  block height. No new blocks, no transaction processing.</li>
<li><strong>Single Byzantine validator</strong>: Only one compromised validator key is required,
  well within IBFT&rsquo;s designed tolerance of f = floor((n-1)/3).</li>
<li><strong>No recovery without intervention</strong>: The stall persists as long as the attacker
  continues sending poisoned RCs. Network restart or attacker removal is required.</li>
<li><strong>MEV extraction</strong>: Attacker controls when chain resumes and who proposes next block.</li>
<li><strong>Market manipulation</strong>: Timed chain halts enable external short positions.</li>
<li><strong>Maps to P1 Criteria B</strong>: &ldquo;gaming consensus for monetary advantage&rdquo;</li>
</ul>
<h2>MEV Escalation, From DoS to Monetary Gain</h2>
<p>The consensus stall is not merely a denial-of-service. The attacker controls WHEN the
chain stalls and WHEN it resumes. Combined with deterministic proposer selection, this
converts the stall into a consensus-level MEV extraction tool.</p>
<h3>Proposer Selection During Round Changes</h3>
<p>Proposer selection is deterministic round-robin (<code>validator/default.go:138-148</code>):</p>
<pre><code class="language-go">func roundRobinProposer(valSet, proposer, round) {
    seed = indexOf(lastProposer) + round + 1
    pick = seed % N
    return valSet.GetByIndex(pick)
}
</code></pre>
<p>During a stall, <code>lastProposer</code> is fixed (last committed block&rsquo;s proposer). The attacker
at validator index <code>A</code> becomes proposer at round:</p>
<pre><code>K = (A - lastProposerIdx - 1) mod N
</code></pre>
<p>This is fully predictable before the attack begins.</p>
<h3>Full MEV Attack Chain</h3>
<ol>
<li>Attacker (1 of N validators) captures PREPARE messages from gossip</li>
<li>Sends ROUND-CHANGE with HasBadProposal=true + arbitrary preparedBlock + mismatched PREPAREs</li>
<li><code>roundChangeSet.Add()</code> accepts due to single-message HasBadProposal bypass (no quorum check)</li>
<li><code>highestPreparedBlock</code> is poisoned → <code>isJustified()</code> fails → no block proposed → round timeout</li>
<li>Attacker re-poisons each round, stalling consensus indefinitely</li>
<li>Attacker monitors mempool during stall, sees all pending transactions accumulating</li>
<li>Attacker calculates round K where they become proposer: <code>K = (attackerIdx - lastProposerIdx - 1) % N</code></li>
<li>At round K, attacker stops poisoning, clean round, attacker is proposer</li>
<li>Attacker&rsquo;s miner constructs block with chosen transaction ordering, frontrunning, sandwich, censorship</li>
<li>Honest validators accept normally, clean round, valid block</li>
<li>Repeat from step 2 for next profitable opportunity</li>
</ol>
<h3>Concrete Scenario</h3>
<p><strong>Setup:</strong> 4 validators (A, B, C, D). Attacker controls A (index 0). Last proposer was D (index 3).</p>
<ul>
<li>Round 0: proposer = (3 + 0 + 1) % 4 = 0 → <strong>Attacker A</strong></li>
<li>Round 1: proposer = (3 + 1 + 1) % 4 = 1 → Validator B</li>
</ul>
<p>If attacker is round 0 proposer:
1. See 100K ETN DEX swap in mempool
2. Build block: [attacker buy] → [victim swap] → [attacker sell]
3. Propose normally (isJustified not checked at round 0)
4. Collect sandwich profit</p>
<p>If attacker is NOT round 0 proposer:
1. Let round 0 proceed, withhold COMMIT → round change
2. Poison rounds until attacker&rsquo;s turn
3. Resume, propose with MEV-optimized block</p>
<h3>Economic Impact</h3>
<ul>
<li>ETN market cap: $17.4M, daily volume: 415K transactions</li>
<li>Timed chain halt + external short position = market manipulation profit</li>
<li>BFT tolerance reduced from (n-1)/3 to 0, single validator breaks all guarantees</li>
<li>Attack costs nothing (no gas, no stake slashing) and is repeatable indefinitely</li>
</ul>
<h2>Affected Code Paths</h2>
<table>
<thead>
<tr>
<th>File</th>
<th>Function</th>
<th>Line</th>
<th>Issue</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>consensus/istanbul/core/roundchange.go</code></td>
<td><code>roundChangeSet.Add()</code></td>
<td>~249</td>
<td>Uses single message&rsquo;s HasBadProposal</td>
</tr>
<tr>
<td><code>consensus/istanbul/core/justification.go</code></td>
<td><code>isJustified()</code></td>
<td>~37-51</td>
<td>Requires quorum of HasBadProposal</td>
</tr>
<tr>
<td><code>consensus/istanbul/core/justification.go</code></td>
<td><code>hasMatchingRoundChangeAndPrepares()</code></td>
<td>~175</td>
<td>Digest bypass with hasBadProposal=true</td>
</tr>
<tr>
<td><code>consensus/istanbul/core/roundchange.go</code></td>
<td><code>handleRoundChange()</code></td>
<td>~118</td>
<td>Uses poisoned highestPreparedBlock</td>
</tr>
<tr>
<td><code>consensus/istanbul/core/core.go</code></td>
<td><code>startNewRound()</code></td>
<td>~183</td>
<td>ClearLowerThan doesn&rsquo;t prevent re-poisoning</td>
</tr>
</tbody>
</table>
<h2>Suggested Fix</h2>
<p>In <code>roundChangeSet.Add()</code>, do NOT use the single message&rsquo;s <code>HasBadProposal</code> flag.
Either:
1. Always require digest match in <code>hasMatchingRoundChangeAndPrepares()</code> when called
   from <code>Add()</code> (set <code>hasBadProposal=false</code>), or
2. Defer the <code>highestPreparedBlock</code> decision until quorum is reached and compute
   <code>hasBadProposal</code> from the full set of RC messages, consistent with <code>isJustified()</code>.</p>
<hr><p style="color:var(--faint);font-size:12.5px;font-family:ui-monospace,Menlo,monospace">Source &middot; github.com/zionboggan/security-research-notebook &middot; writeups/electroneum/qbft-hasbadproposal-consensus-stall.md</p>
</div></div></section>
<footer><div class="wrap row">
  <div class="links"><a href="/">Portfolio</a><a href="https://www.linkedin.com/in/zion-boggan">LinkedIn</a><a href="/security-research-notebook/">Notebook</a><a href="mailto:zionboggan0@gmail.com">Email</a></div>
  <div class="note">Coordinated-disclosure research. Findings appear here only after the program's disclosure window closed, the patch shipped, or a CVE was published. No customer data was accessed.</div>
</div></footer>
</body></html>