NRDAX-T0292 - Sync Height Manipulation Stall
Pending classification · active · first seen 2026-07-09
Producer label: memory_amp. Not yet assigned a mechanism family.
provenance: Reproduced in NullRabbit's attack-reproduction pipeline
mechanism
CVE-2025-24371 (ASA-2025-001 / GHSA-22qq-3xwm-r5x4): a malicious CometBFT blocksync peer disrupts a node's ability to sync. In blocksync a peer reports its base/latest heights in a StatusResponse; the attacker advertises an inflated `latest` (the sync target) then advertises LOWER heights. The target is never recalculated downward, so the node tries to catch up to an unreachable height indefinitely → blocksync deadlock (restarted/new nodes cannot rejoin). Affected cometbft <= v0.38.16 and v1.0.0; fixed v0.38.17, v1.0.1. Wire signature: StatusResponse frames whose `latest` spikes high then steps DOWN, plus BlockRequests answered only by NoBlockResponse on the Blocksync channel 0x40.
live exposure
No exposure data. Slashr ↗ has no risk signal mapped to this technique yet — absence of data is not absence of exposure.
instances (1)
| chain | primitive | fidelity | origin | reproducer (bundle) | source |
|---|---|---|---|---|---|
| cosmos | cometbft_blocksync_height_decrease_stuck | lab | reverse-engineered-cve | cometbft_blocksync_height_decrease_stuck | CVE-2025-24371 |
cite
https://nrdax.com/techniques/NRDAX-T0292
NRDAX Registry. Technique NRDAX-T0292.
@misc{nrdax_NRDAX_T0292,
title = {Sync Height Manipulation Stall (NRDAX-T0292)},
howpublished = {NRDAX Registry},
url = {https://nrdax.com/techniques/NRDAX-T0292},
} {
"id": "nrdax-NRDAX-T0292",
"type": "dataset",
"title": "Sync Height Manipulation Stall (NRDAX-T0292)",
"URL": "https://nrdax.com/techniques/NRDAX-T0292",
"publisher": "NRDAX Registry"
} 
[](https://nrdax.com/techniques/NRDAX-T0292-sync-height-manipulation-stall)
use from the CLI
Retrieve or cite this technique from a script or the terminal with the NRDAX Python library & CLI.
nrdax get NRDAX-T0292nrdax cite NRDAX-T0292 --format bibtex