DV Labs Charon Pedersen DKG

Findings · 9

1. 1 Complete cluster replacement produces invalid shares Medium
2. 2 Missing threshold validation in DKG operations Low
3. 3 Unbounded buffer allocation in the sync protocol enables denial of service Medium
4. 4 Node signature broadcast callback does not verify sender identity against claimed peer index Informational
5. 5 Share index remapping bug causes signature verification failures during DKG Medium
6. 6 Nonce reuse across multiple DKG iterations enables replay attacks Medium
7. 7 restoreCommits panics on out-of-bounds shareNum Medium
8. 8 New nodes lack polynomial commitment validation during reshare Medium
9. 9 Unbounded buffer allocation in FetchDefinition enables memory exhaustion Low

Findings extracted from the published report PDF. See the full report below for details and remediation.