Security News > 2022 > October > Critical Flaw Reported in Move Virtual Machine Powering the Aptos Blockchain Network

Researchers have disclosed details about a now-patched critical flaw in the Move virtual machine that powers the Aptos blockchain network.

The vulnerability "Can cause Aptos nodes to crash and cause denial of service," Singapore-based Numen Cyber Labs said in a technical write-up published earlier this month.

The network is built using a platform-agnostic programming language known as Move, a Rust-based system that's designed to implement and execute smart contracts in a secure runtime environment, also known as the Move Virtual Machine.

The vulnerability identified by Numen Cyber Labs is rooted in the Move language's verification module, a component that validates the bytecode instructions prior to its execution in MoveVM. Specifically, it relates to an integer overflow vulnerability in the stack-based Web3 programming language that could result in undefined behavior and therefore crashes.

"Since this vulnerability occurs in the Move execution module, for nodes on the chain, if the bytecode code is executed, it will cause a attack," the cybersecurity firm explained.

"In severe cases, the Aptos network can be completely stopped, which will cause incalculable damage, and have a serious impact on the stability of the node."

News URL

https://thehackernews.com/2022/10/critical-flaw-reported-in-move-virtual.html