go-f3 module vulnerable to integer overflow leading to panic

Vulnerability

Overview

go-f3, the Golang implementation of Fast Finality for Filecoin (F3), contains a vulnerability in versions 0.8.6 and below where a specially crafted "poison" message triggers an integer overflow during signer index validation. This overflow causes a panic in the validator, crashing the consuming node. The bug was discovered through a combination of a bug bounty report and further internal investigation [1][3].

Exploitation

Conditions

An attacker must directly send the poison message to each target node; the vulnerability does not self-propagate because the flaw resides in the validator, not in message propagation [3]. There are no authentication or power requirements—any attacker capable of sending messages to a node's F3 interface can exploit this [3].

Impact

Successful exploitation causes the target node to panic and crash, resulting in a denial-of-service (DoS) condition. For Lotus nodes, this crash affects the entire node, disrupting Filecoin network participation [3]. No other impacts (e.g., data corruption or remote code execution) are described in the primary sources.

Mitigation

The fix was merged and released in go-f3 version 0.8.7, which adds proper overflow checking using math.MaxInt64 and returns an error instead of panicking [3]. All Filecoin node software (Lotus, Forest, Venus) have adopted this fix as part of the nv27 network upgrade. There are no viable workarounds; upgrading to the patched version is required [3].