CVE-2026-82407: Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS
Location: core/kapp/validators/validators.go:201 (Register), (genesis/checking/nodesSetupChecker.go:73). core/consensus/slot/bls/subslotStartSlot.go:165 core/consensus/.../headerSignatureVerify.go:123 (Create(...)).
Description
Klever uses a BDN (Boneh-Drijvers-Neven) BLS multi-signature over BLS12-381 to finalize blocks (crypto/signing/mcl/multisig/bls.go, herumi/bls-go-binary). The library is initialized with only bls.Init(bls.BLS12381) and no order-verification flags, so Deserialize does not enforce prime-order-subgroup membership subgroup safety relies on explicit IsValidOrder() calls in the wrappers.
Runtime validator registration (validators.Register) stores the submitted 96-byte BLSPublicKey via SetBLSPublicKey with no curve check, no subgroup check, and no proof-of-possession (CreateValidatorContract carries the key but no signature proving key ownership; grep confirms no proofOfPossession/VerifyProof/BLSSignature verification anywhere in core/kapp/validators/). CheckPublicKeyValid — which does IsValid && IsValidOrder && !IsZero — runs only at genesis, not on runtime registration/update.
POC
Attack: (1) stake the minimum to register a validator, submitting a 96-byte BLSPublicKey that is not a valid G2 point (arbitrary bytes). Registration succeeds. (2) Once the validator is eligible and selected into a consensus group, every in-group node including the honest leader (group[0]) calls MultiSigner().Reset(groupPubKeys, selfIndex) at slot start, which deserializes all group keys via PublicKeyFromByteArray → herumi Deserialize deterministically fails on the malformed key → SetSlotCanceled(true). The verify side (Create(consensusPubKeys)) fails identically. No block is produced for that round.
Impact
Every consensus round whose group contains the malformed-key validator is a missed slot. One eligible bad-key validator poisons roughly a groupSize / eligibleSet fraction of rounds → sustained liveness degradation. Where the consensus group equals the eligible set (small or early-stage networks), this is a full chain halt. Cost is the minimum validator stake, permissionless, and repeatable; no fork flag gates the missing validation.
Rated High (Byzantine liveness; Critical on small validator sets). The severity scales down to a fractional missed-slot / throughput-degradation attack on a large validator set where the bad validator is only occasionally in the active group.
Recommendation
Enforce CheckPublicKeyValid (curve + prime-order subgroup + non-zero) on the submitted BLS key at runtime validator registration and config-update, and ideally require a proof-of-possession (a BLS signature over the validator's own key/identity) at registration to prove key ownership and well-formedness. Gate the stricter validation behind an epoch fork flag for reprocessing consistency.
Other sources
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed key becomes eligible and is selected into a consensus group, MultiSigner.Reset and the corresponding signature verification creation path cannot deserialize the group key and cancel the slot. This causes repeated missed rounds and throughput degradation, and a network whose consensus group equals the eligible validator set can halt completely. Genesis validation is not affected because that path already performs CheckPublicKeyValid. This issue is fixed in version 1.7.20.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/klever-io/klever-goto a version that resolves this vulnerability.Fixed in 1.7.20 - Upgrade
Upgrade
Klever-Goto a version that resolves this vulnerability.Fixed in 1.7.20 - Configuration
Enforce CheckPublicKeyValid on submitted BLSPublicKey values during runtime validator registration and configuration updates; validation must require a valid curve point, prime-order subgroup membership, and a non-zero key.
Klever-Go validator registration and runtime validator update CheckPublicKeyValid = enabled - Configuration
Require a BLS proof-of-possession signature over the validator's own key or identity during registration.
Klever-Go validator registration BLS proof-of-possession = required - Configuration
Gate the stricter runtime BLS public-key validation behind an epoch fork flag to preserve reprocessing consistency.
Klever-Go validator key validation epoch fork flag = enabled
Event History
Frequently Asked Questions
Which validator key paths require review?
Review validator registrations and runtime validator updates submitted before upgrading, because both paths accepted BLS public keys without curve, subgroup, or nonzero validation. Genesis validator-key validation is not affected.
What must happen for the issue to disrupt consensus?
A validator with a malformed BLS public key must become eligible and be selected for a consensus group. The group-key deserialization then fails during multisignature reset or signature-verification setup, canceling the slot.
How severe can the availability impact become?
The issue can cause repeated missed rounds and reduced throughput. If the consensus group is the same as the eligible validator set, the network can halt completely.
What version contains the fix?
Klever-Go version 1.7.20 fixes the issue.