🔒 Kazuya

Identified an algorithmic complexity vulnerability in the Chia Rust-native CLVM bridge where bytes(program) or repr(program) materializes an expanded serialization of 2^(N+1)-1 bytes, leading to OOM conditions (N=20→2MB, N=30→2GB, N=40→2TB). No authentication required. PoC with measured timing (4,096ms vs 0.02ms baseline), root cause analysis, and negative control.

The Sign RPC in arc-remote-signer does not validate enclave attestation freshness, while PublicKey does. Broken security invariant: a compromised enclave with expired attestation can continue signing arbitrary messages undetected. Independently discovered; closed as duplicate of prior submission, confirming validity.

Privilege escalation via overwriting /etc/sudoers to grant passwordless sudo, rendering the system unbootable, and data destruction by truncating root-owned files.

malachite (96K lines, Rust) — BFT consensus engine. Audited proposal/vote validation, BLS/Ed25519 crypto, state machine logic.
arc-node (168K lines, Rust) — Blockchain node. Audited EVM frame stack, unsafe blocks, env config.
arc-remote-signer (25K lines, Go) — TEE remote signer. Audited gRPC server, AWS KMS proxy, vsock routing, enclave crypto. Found attestation bypass + DoS vectors.

Algorithmic complexity DoS in CLVM serialization. Method: timing analysis, root cause isolation, PoC with negative control.