📢 Gate Square Exclusive: #WXTM Creative Contest# Is Now Live!
Celebrate CandyDrop Round 59 featuring MinoTari (WXTM) — compete for a 70,000 WXTM prize pool!
🎯 About MinoTari (WXTM)
Tari is a Rust-based blockchain protocol centered around digital assets.
It empowers creators to build new types of digital experiences and narratives.
With Tari, digitally scarce assets—like collectibles or in-game items—unlock new business opportunities for creators.
🎨 Event Period:
Aug 7, 2025, 09:00 – Aug 12, 2025, 16:00 (UTC)
📌 How to Participate:
Post original content on Gate Square related to WXTM or its
Newly discovered integer overflow vulnerability in Move language may cause node crash
A new integer overflow vulnerability discovered in Move language
Recently, security researchers discovered a new integer overflow vulnerability while deeply analyzing the Move language. This vulnerability occurs during the reference safety verification process of the Move language and could lead to node crashes.
The Move language performs code verification before executing bytecode, which consists of four steps. This vulnerability exists in the reference_safety step. The reference safety verification mainly checks for dangling references, whether mutable reference access is safe, and whether global storage reference access is safe, among other things.
The verification process will analyze each basic block. A basic block is a sequence of code that has no branch instructions except for entry and exit. Move identifies basic blocks by traversing the bytecode and looking for branch and loop instructions.
The main process of verifying the security of references is: executing the code for each basic block, generating the state after execution, then merging the states before and after execution, updating the block state and propagating it to subsequent blocks. This process is repeated until the state no longer changes or an error occurs.
The vulnerability occurs during the merge state process. If the length of the function parameters plus the length of the local variables exceeds 256, it will lead to an overflow of the u8 type. Although there is code that checks the number of local variables, it does not include the length of the parameters.
Using this overflow can change the state of the block, making the old and new states different. When executing the basic block again, accessing an index that does not exist in the new state will cause the program to crash.
Researchers have provided a proof-of-concept code that can trigger this vulnerability, causing the node to crash. This indicates that even statically typed languages may have security issues, making code auditing very important. It is recommended that the Move language implement more security checks at runtime, not just during the validation phase.
The discovery of this vulnerability once again shows that there is no absolutely secure code. Even strongly typed languages can have vulnerabilities. Security researchers will continue to analyze the Move language in depth to look for more potential issues.