Listen to this Post
The vulnerability exploits an inconsistency between the verification of commit signatures and the derivation of the final block time in CometBFT’s “BFT Time” protocol. In a correct BFT Time operation, validators sign a proposed block, which includes a timestamp. The protocol is designed to calculate the final block time as the median of the timestamps from the validator signatures, preventing a single faulty node from arbitrarily altering the time. The flaw allows a Byzantine (faulty) validator to break the guarantee that time cannot be arbitrarily increased. The attacker can achieve this by selectively withholding or delaying their pre-commit signature for a block. They then submit their signature with a significantly higher future timestamp after observing signatures from enough honest validators. During the block time derivation logic, this maliciously high timestamp is included in the set used to calculate the median. This can corrupt the median calculation, causing the final agreed-upon block time to be incorrectly skewed forward. The core failure is that signature validity checks did not adequately enforce constraints on the timestamp associated with the signature relative to the consensus process. This lets a faulty process inject an illegitimate future timestamp into the consensus decision after the fact.
Platform: CometBFT
Version: v0.38.21/v0.37.18
Vulnerability: BFT Time manipulation
Severity: Critical
date: January 23, 2026
Prediction: January 23, 2026
What Undercode Say:
cometbft version Check current node version sudo apt-get update && sudo apt-get install cometbft Upgrade via package manager sudo systemctl restart cometbft Restart service after upgrade
How Exploit:
1. Malicious validator withholds pre-commit.
2. Observes honest validator signatures.
3. Injects signature with future timestamp.
4. Skews median block time calculation.
5. Compromises timestamp-dependent applications.
Protection from this CVE
Immediate upgrade required.
No viable workaround exists.
Apply v0.38.21 patch.
Apply v0.37.18 patch.
Impact:
Corrupts block timestamps.
Affects timestamp-dependent contracts.
Risks DeFi protocol logic.
Undermines consensus guarantee.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
