NRDAX-T0403 - DHT First-Record Verification Bypass

gossip_abuse · active · first seen 2026-07-17

provenance: Reproduced in NullRabbit's attack-reproduction pipeline

mechanism

handle_dht_get only creates the DhtResults accumulator when the FIRST returned Kademlia record verifies successfully; it never falls back to a later valid record if that first responder's record fails verification. A malicious peer wins the race by answering the get first with a well-formed but unverifiable record (e.g. correct-length but all-zero signature), causing the accumulator to never be initialized. Every subsequent honest, valid record is then compared against the missing/poisoned state and discarded as inconsistent, denying the querying node the real value and blocking peer/validator discovery and routing (improper handling of an unusual/exceptional first-response condition, CWE-754).

instances (1)

chain	primitive	fidelity	origin	reproducer (bundle)	source
nimiq	nimiq_dht_get_first_record_poison	lab	reverse-engineered-cve	nimiq_dht_get_first_record_poison	-

related (gossip_abuse)

NRDAX-T0001 - Addr Message Counter Overflow Crash active NRDAX-T0050 - DHT Sybil Content Censorship active NRDAX-T0120 - Integer-Overflow Panic Control Message active NRDAX-T0188 - Oversized Control-Message Array CPU Burn active NRDAX-T0192 - Oversized Transaction Block-Fill active NRDAX-T0199 - Peer-Record Flood OOM active NRDAX-T0295 - Sync-State Poisoning Via Fake Blocks active NRDAX-T0312 - Tx-Relay Throughput Jamming active

cite

https://nrdax.com/techniques/NRDAX-T0403

plain

NRDAX Registry. Technique NRDAX-T0403.

bibtex

@misc{nrdax_NRDAX_T0403,
  title = {DHT First-Record Verification Bypass (NRDAX-T0403)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0403},
}

json (csl)

{
  "id": "nrdax-NRDAX-T0403",
  "type": "dataset",
  "title": "DHT First-Record Verification Bypass (NRDAX-T0403)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0403",
  "publisher": "NRDAX Registry"
}

badge

[![NRDAX-T0403 in the NRDAX registry](https://nrdax.com/badge/NRDAX-T0403.svg)](https://nrdax.com/techniques/NRDAX-T0403-dht-first-record-verification-bypass)

use from the CLI

Retrieve or cite this technique from a script or the terminal with the NRDAX Python library & CLI.

Retrieve this technique

nrdax get NRDAX-T0403

Cite it (BibTeX)

nrdax cite NRDAX-T0403 --format bibtex

CLI guide → GitHub ↗