Cosmos researcher drops high‑severity CometBFT zero‑day securing over $8B

crypto.news 2 h

Security

Researcher Doyeon Park drops a high‑severity CometBFT zero‑day that can stall Cosmos chains securing $8B, spotlighting disclosure gaps in core crypto infrastructure.

A critical zero‑day vulnerability in Cosmos’ CometBFT consensus layer has been publicly disclosed by security researcher Doyeon Park, raising fresh questions over coordinated disclosure practices in core blockchain infrastructure. Park said the bug, rated CVSS 7.1 (High), can cause nodes across Cosmos‑based chains to stall during the block synchronization phase, potentially disrupting networks that together secure more than $8 billion in on‑chain value.

I’m disclosing a 0-day vulnerability in the Cosmos consensus layer (CometBFT).

This is a CVSS 7.1 (High) severity issue that can cause nodes in the Cosmos ecosystem—which secures over $8B+ in assets—to stall during the block synchronization phase. However, direct asset theft is… pic.twitter.com/89XeHmvjBK
— Doyeon Park (@p6rkdoye0n) April 21, 2026

Researcher escalates after failed disclosure talks

In a post on X, Park wrote that the issue does not allow “direct asset theft,” but warned that halting or delaying block production across multiple chains remains a serious operational and economic risk for validators, applications, and users. The researcher added that they chose to disclose the exploit publicly only after attempts to resolve the issue through standard coordinated vulnerability disclosure channels broke down due to a “lack of cooperation” from the vendor.

Consensus stability under scrutiny

Because CometBFT underpins consensus for many Cosmos‑SDK‑based chains, a stall during block sync can ripple through the broader ecosystem, affecting everything from IBC transfers to DeFi protocols built on top of affected networks. Even without funds at immediate risk, sustained node stalls can trigger governance emergencies, slashing debates, and liquidity disruptions, especially on chains that serve as core routing hubs or host dollar‑denominated stablecoins.

Park’s decision to go public highlights the tension between open‑source transparency and the need to quietly patch critical bugs in systems that now secure multi‑billion‑dollar asset pools.
For Cosmos stakeholders, the incident is likely to accelerate calls for more formalized security response processes and clearer expectations around disclosure timelines for consensus‑layer vulnerabilities.