CVE-2021-21405Medium· 5.9▾ Sunlit

BLS Signature "Malleability"

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score33/ 100 · Low

impact 32.5 · likelihood 0.2 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

May 21, 2021

Updated

Jul 8, 2026

CVSS

5.9

Vendor

filecoin-project

Product

github.com/filecoin-project/lotus

CWE

—

Depth score

33 · Low

EPSS

0.98% · p60

Platforms

—

Source

OSV

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS history

Exploit-prediction probability, daily snapshots since Jul 9.

1.0% → 1.0%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 1875 days

May 21, 2021Published
Disclosed via OSV
Jul 8, 2026Record revised
Last analysed / modified upstream
Jul 9, 2026EPSS first tracked
1.0%

filecoin-project #osv #go

Affected

github.com/filecoin-project/lotus < 1.5.0

Patched in

github.com/filecoin-project/lotus 1.5.0

Full technical detail▾

Overview

Impact

BLS signature validation in lotus uses blst library method VerifyCompressed. This method accepts signatures in 2 forms - "serialized", and "compressed", meaning that BLS signatures can be provided as either of 2 unique byte arrays.
Lotus block validation functions perform a uniqueness check on provided blocks. Two blocks are considered distinct if the CIDs of their blockheader do not match. The CID method for blockheader includes the BlockSig of the block.

The result of these issues is that it would be possible to punish miners for valid blocks, as there are two different valid block CIDs available for each block, even though this must be unique.

Patches

By switching from the go based blst bindings over to the bindings in filecoin-ffi, the code paths now ensure that all signatures are compressed by size and the way they are deserialized. This happened in https://github.com/filecoin-project/lotus/pull/5393

References

Original POC: https://gist.github.com/wadeAlexC/2490d522e81a796af9efcad1686e6754

Affected packages

github.com/filecoin-project/lotus < 1.5.0

Remediation

Upgrade to a patched release:

github.com/filecoin-project/lotus 1.5.0

References

#osv#go

Overview

Impact

BLS signature validation in lotus uses blst library method VerifyCompressed. This method accepts signatures in 2 forms - "serialized", and "compressed", meaning that BLS signatures can be provided as either of 2 unique byte arrays.

Lotus block validation functions perform a uniqueness check on provided blocks. Two blocks are considered distinct if the CIDs of their blockheader do not match. The CID method for blockheader includes the BlockSig of the block.

The result of these issues is that it would be possible to punish miners for valid blocks, as there are two different valid block CIDs available for each block, even though this must be unique.

Patches

References