CVE-2025-59941
📋 TL;DR
This vulnerability in go-f3 allows attackers to bypass justification verification by reusing cached valid justifications in invalid contexts. It affects all systems running go-f3 versions 0.8.8 and below that use the Fast Finality implementation for Filecoin. Attackers could potentially manipulate consensus decisions by exploiting the caching mechanism.
💻 Affected Systems
- go-f3
📦 What is this software?
Go F3 by Filecoin
⚠️ Risk & Real-World Impact
Worst Case
An attacker could manipulate consensus outcomes, potentially causing network forks, double-spending attacks, or disruption of Filecoin's Fast Finality mechanism, compromising blockchain integrity.
Likely Case
Attackers could cause temporary consensus inconsistencies or delays in finality decisions, disrupting normal network operations without complete network takeover.
If Mitigated
With proper monitoring and quick patch deployment, impact would be limited to minor service disruptions that are quickly detected and resolved.
🎯 Exploit Status
Exploitation requires understanding of Filecoin's F3 consensus mechanism and ability to submit messages to the network. No public exploit code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.8.9
Vendor Advisory: https://github.com/filecoin-project/go-f3/security/advisories/GHSA-7pq9-rf9p-wcrf
Restart Required: No
Instructions:
1. Update go-f3 to version 0.8.9 or higher using 'go get github.com/filecoin-project/go-f3@v0.8.9' 2. Rebuild and redeploy your application 3. Verify the update was successful
🔧 Temporary Workarounds
Disable justification caching
allTemporarily disable the justification verification caching mechanism to prevent exploitation
Set environment variable GO_F3_DISABLE_JUSTIFICATION_CACHE=true
🧯 If You Can't Patch
- Implement strict monitoring for unusual consensus behavior or justification reuse patterns
- Isolate vulnerable nodes from critical network functions and limit their participation in consensus
🔍 How to Verify
Check if Vulnerable:
Check go-f3 version with 'go version -m $(which go-f3)' or examine go.mod for go-f3 dependency versionCheck Version:
go version -m $(which go-f3) 2>/dev/null || grep go-f3 go.modVerify Fix Applied:
Confirm version is 0.8.9 or higher and test justification verification with different message contexts📡 Detection & Monitoring
Log Indicators:
- Multiple justification reuse warnings
- Consensus verification failures
- Unexpected cache hits for justification verification
Network Indicators:
- Unusual message propagation patterns
- Increased justification-related network traffic
SIEM Query:
source="go-f3" AND ("justification cache" OR "verification bypass" OR "CVE-2025-59941")