Root cause
Validation & fail-open logic introduced
feat(network): add ARC broadcaster with injectable HTTP client
The AI-written broadcaster only treats REJECTED and DOUBLE_SPEND_ATTEMPTED as failures, so invalid, malformed, or stale ARC responses are silently accepted as successful broadcasts.
How AI contributed: Direct introductionPublished Apr 9, 2026 in 
sgbett/bsv-ruby-sdkAll 2 findings in this repository
Show full advisory descriptionHide advisory description
ARC broadcaster treats failure statuses as successful broadcasts Summary BSV::Network::ARC's failure detection only recognises REJECTED and DOUBLE_SPEND_ATTEMPTED. ARC responses with txStatus values of INVALID, MALFORMED, MINED_IN_STALE_BLOCK, or any ORPHAN-containing extraInfo / txStatus are silently treated as successful broadcasts. Applications that gate actions on broadcaster success are tricked into trusting transactions that were never accepted by the network. Details lib/bsv/network/arc.rb (lines ~74-100 in the affected code) uses a narrow failure predicate compared to the TypeScript reference SDK. The TS broadcaster additionally recognises: · INVALID · MALFORMED · MINED_IN_STALE_BLOCK · Any response containing ORPHAN in extraInfo or txStatus The Ruby implementation omits all of these, so ARC responses carrying any of these statuses are returned to the caller as successful broadcasts. Additional divergences in the same module compound the risk: · Content-Type is sent as application/octet-stream; the TS reference sends application/json with a { rawTx: <hex> } body (EF form where source transactions are available). · The headers XDeployment-ID, X-CallbackUrl, and X-CallbackToken are not sent. The immediate security-relevant defect is the missing failure statuses; the other divergences are fixed in the same patch for protocol compliance. Impact Integrity: callers receive a success response for broadcasts that were actually rejected by the ARC endpoint. Applications and downstream gems that gate actions on broadcaster success — releasing goods, marking invoices paid, treating a token as minted, progressing a workflow — are tricked into trusting transactions that were never broadcast. This is an integrity bug with security consequences. It does not disclose information (confidentiality unaffected) and does not affect availability. CVSS rationale AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N → 7.5 (High) · AV:N — network-reachable. · AC:L — no specialised access conditions are required. Triggering any of the unhandled failure statuses is not meaningfully harder than broadcasting a transaction at all: a malformed or invalid transaction, an orphan condition from a transient fork, or a hostile/misbehaving ARC endpoint returning one of these statuses is sufficient. The attacker does not need to defeat any mitigation or race a specific window — the bug is that the code path doesn't exist at all. · PR:N — no privileges required. · UI:N — no user interaction. · C:N — no confidentiality impact. · I:H — downstream integrity decisions are taken on non-broadcast transactions. · A:N — no availability impact. Affected versions The ARC broadcaster was introduced in commit a1f2e62 ("feat(network): add ARC broadcaster with injectable HTTP client") on 2026-02-08 and first released in v0.1.0. The narrow failure predicate has been present since introduction. Every release up to and including v0.8.1 is affected. Affected range: >= 0.1.0, < 0.8.2. Patches Upgrade to bsv-sdk >= 0.8.2. The fix: · Expands the failure predicate (REJECTED_STATUSES + ORPHAN substring check on both txStatus and extraInfo) to include INVALID, MALFORMED, MINED_IN_STALE_BLOCK, and any orphan-containing response, matching the TypeScript reference. · Switches Content-Type to application/json with a { rawTx: <hex> } body, preferring Extended Format (BRC-30) hex when every input has source_satoshis and source_locking_script populated and falling back to plain raw-tx hex otherwise. · Adds support for the XDeployment-ID (default: random bsv-ruby-sdk-<hex>), X-CallbackUrl, and X-CallbackToken headers via new constructor keyword arguments. Fixed in sgbett/bsv-ruby-sdk#306. Note for bsv-wallet consumers The sibling gem bsv-wallet (published from the same repository) is not independently vulnerable — lib/bsv/network/arc.rb is not bundled into the wallet gem's files list. However, bsv-wallet runtime-depends on bsv-sdk, so a consumer of bsv-wallet that also invokes the ARC broadcaster is transitively exposed whenever Gemfile.lock resolves to a vulnerable bsv-sdk version. bsv-wallet >= 0.3.4 tightens its bsv-sdk constraint to >= 0.8.2, < 1.0, so upgrading either gem is sufficient to pull in the fix. Workarounds If upgrading is not immediately possible: · Verify broadcast results out-of-band (e.g. query a block explorer or WhatsOnChain) before treating a transaction as broadcast. · Do not gate integrity-critical actions solely on the ARC broadcaster's success response. Credit Identified during the 2026-04-08 cross-SDK compliance review, tracked as finding F5.13. References · HLR: sgbett/bsv-ruby-sdk#305 · Fix PR: sgbett/bsv-ruby-sdk#306 · Compliance review: .architecture/reviews/20260408-cross-sdk-compliance-review.md · TypeScript reference: ARC class in @bsv/sdk
What actually happenedHide details
The broadcaster added to lib/bsv/network/arc.rb classified only REJECTED and DOUBLE_SPEND_ATTEMPTED as failures, so ARC responses whose txStatus was INVALID, MALFORMED or MINED_IN_STALE_BLOCK, or whose extraInfo contained ORPHAN, were handed back to callers as successful broadcasts. The fix broadens that predicate and switches the request to the JSON envelope the endpoint expects.
Fix
Security fix
fix(security): A1 security hotfixes from 2026-04-08 compliance review
AI-assisted fix: Claude Code · Simon Bettison
Case facts
- CVE ID
- CVE-2026-40069
- GHSA ID
- GHSA-9HFR-GW99-8RHX
- Published
- Apr 9, 2026
- Severity
- HIGH
- Language
- Ruby
- AI tool
Claude- AI role
- Direct introduction
- Vulnerable release
- v0.8.1
- Fixed release
- v0.8.2
AI-assisted change
AI-assisted changelib/bsv/network/arc.rbsource sgbett/bsv-ruby-sdk@a1f2e62cb3+113−0
diff --git a/lib/bsv/network/arc.rb b/lib/bsv/network/arc.rbnew file mode 100644index 0000000..de66098--- /dev/nullShow 15 hidden lines
+++ b/lib/bsv/network/arc.rb@@ -0,0 +1,113 @@+# frozen_string_literal: true++require 'net/http'+require 'json'+require 'uri'++module BSV+ module Network+ # ARC broadcaster for submitting transactions to the BSV network.+ #+ # Any object responding to #broadcast(tx) can serve as a broadcaster;+ # this class implements that contract using the ARC API.+ #+ # The HTTP client is injectable for testability. It must respond to+ # #request(uri, request) and return an object with #code and #body.+ class ARC+ REJECTED_STATUSES = %w[REJECTED DOUBLE_SPEND_ATTEMPTED].freeze++ def initialize(url, api_key: nil, http_client: nil)+ @url = url.chomp('/')Show 54 hidden lines
+ @api_key = api_key+ @http_client = http_client+ end++ # Submit a transaction to ARC.+ # Returns BroadcastResponse on success, raises BroadcastError on failure.+ def broadcast(tx)+ uri = URI("#{@url}/v1/tx")+ request = Net::HTTP::Post.new(uri)+ request['Content-Type'] = 'application/octet-stream'+ apply_auth_header(request)+ request.body = tx.to_binary++ response = execute(uri, request)+ handle_broadcast_response(response)+ end++ # Query the status of a previously submitted transaction.+ # Returns BroadcastResponse on success, raises BroadcastError on failure.+ def status(txid)+ uri = URI("#{@url}/v1/tx/#{txid}")+ request = Net::HTTP::Get.new(uri)+ apply_auth_header(request)++ response = execute(uri, request)+ handle_broadcast_response(response)+ end++ private++ def apply_auth_header(request)+ request['Authorization'] = "Bearer #{@api_key}" if @api_key+ end++ def execute(uri, request)+ if @http_client+ @http_client.request(uri, request)+ else+ Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|+ http.request(request)+ end+ end+ end++ def handle_broadcast_response(response)+ body = parse_json(response.body)+ code = response.code.to_i++ unless (200..299).cover?(code)+ raise BroadcastError.new(+ body['detail'] || body['title'] || "HTTP #{code}",+ status_code: code,+ txid: body['txid']+ )+ end++ tx_status = body['txStatus']+ if rejected_status?(tx_status)+ raise BroadcastError.new(+ body['detail'] || body['title'] || tx_status,+ status_code: code,Show 4 hidden lines
+ txid: body['txid']+ )+ end++ build_response(body)+ end++ def rejected_status?(tx_status)+ REJECTED_STATUSES.include?(tx_status)+ end++ def parse_json(raw)Show 20 hidden lines
+ JSON.parse(raw)+ rescue JSON::ParserError+ { 'detail' => raw }+ end++ def build_response(body)+ BroadcastResponse.new(+ txid: body['txid'],+ tx_status: body['txStatus'],+ message: body['title'],+ extra_info: body['extraInfo'],+ block_hash: body['blockHash'],+ block_height: body['blockHeight'],+ timestamp: body['timestamp'],+ competing_txs: body['competingTxs']+ )+ end+ end+ end+endThe ARC broadcaster sends the raw transaction binary and treats only a narrow rejected status list as failure. Statuses the API can return outside that list are silently treated as success, and client-facing header values are built from the raw txid without normalization.
Security fix
Fixlib/bsv/network/arc.rbsource sgbett/bsv-ruby-sdk@db97de4755+39−11
diff --git a/lib/bsv/network/arc.rb b/lib/bsv/network/arc.rbindex 0fccbaf..81d7004 100644--- a/lib/bsv/network/arc.rb+++ b/lib/bsv/network/arc.rbShow 11 hidden lines
@@ -5,0 +6 @@ require 'uri'+require 'securerandom'@@ -17,3 +18,27 @@ module BSV- REJECTED_STATUSES = %w[REJECTED DOUBLE_SPEND_ATTEMPTED].freeze-- def initialize(url, api_key: nil, http_client: nil)+ REJECTED_STATUSES = %w[+ REJECTED+ DOUBLE_SPEND_ATTEMPTED+ INVALID+ MALFORMED+ MINED_IN_STALE_BLOCK+ ].freeze++ ORPHAN_MARKER = 'ORPHAN'++ def initialize(url, api_key: nil, deployment_id: nil, callback_url: nil,+ callback_token: nil, http_client: nil)Show 36 hidden lines
@@ -21,0 +47,3 @@ module BSV+ @deployment_id = deployment_id || "bsv-ruby-sdk-#{SecureRandom.hex(8)}"+ @callback_url = callback_url+ @callback_token = callback_token@@ -26,0 +55,5 @@ module BSV@@ -34 +67,2 @@ module BSV- # @raise [BroadcastError]@@ -38 +72,2 @@ module BSV- request['Content-Type'] = 'application/octet-stream'+ request['Content-Type'] = 'application/json'+ request['XDeployment-ID'] = @deployment_id@@ -39,0 +75,2 @@ module BSV+ request['X-CallbackUrl'] = @callback_url if @callback_url+ request['X-CallbackToken'] = @callback_token if @callback_token@@ -41 +78 @@ module BSV- request.body = tx.to_binary+ request.body = JSON.generate(rawTx: raw_tx_hex(tx))@@ -51,0 +89 @@ module BSV+ request['XDeployment-ID'] = @deployment_id@@ -59,0 +98,9 @@ module BSV+ def raw_tx_hex(tx)+ tx.to_ef_hex+ rescue ArgumentError+ tx.to_hex+ end+@@ -86,2 +133 @@ module BSV- tx_status = body['txStatus']- if rejected_status?(tx_status)+ if rejected_status?(body)@@ -89 +135 @@ module BSV- body['detail'] || body['title'] || tx_status,+ body['detail'] || body['title'] || body['txStatus'],@@ -98,2 +144,9 @@ module BSV- def rejected_status?(tx_status)- REJECTED_STATUSES.include?(tx_status)+ def rejected_status?(body)+ tx_status = body['txStatus']+ return true if REJECTED_STATUSES.include?(tx_status)+ return true if tx_status.is_a?(String) && tx_status.include?(ORPHAN_MARKER)++ extra_info = body['extraInfo']+ return true if extra_info.is_a?(String) && extra_info.include?(ORPHAN_MARKER)++ falseThe failure classification now expands to cover invalid, malformed, stale-block, and orphan markers found either in the status field or the extra info text, and the request format changes to a JSON envelope with a per-deployment identifier. txid-derived output is cleaned up through the extra info check.
Fixlib/bsv/transaction/var_int.rbsource sgbett/bsv-ruby-sdk@db97de4755+5−1
diff --git a/lib/bsv/transaction/var_int.rb b/lib/bsv/transaction/var_int.rbindex d0faf51..22f4288 100644--- a/lib/bsv/transaction/var_int.rb+++ b/lib/bsv/transaction/var_int.rb@@ -12,0 +13,3 @@ module BSV+ MAX_UINT64 = 0xFFFF_FFFF_FFFF_FFFF+@@ -15 +18 @@ module BSV- # @param value [Integer] non-negative integer to encode@@ -16,0 +20 @@ module BSV@@ -17,0 +22,3 @@ module BSV+ raise ArgumentError, "varint requires non-negative integer, got #{value}" if value.negative?+ raise ArgumentError, "varint value #{value} exceeds uint64 max (#{MAX_UINT64})" if value > MAX_UINT64+The varint encoder now rejects negative values and anything above the uint64 ceiling, so quick transactions and adversarial sizes can no longer be coerced into a malformed lower bound by the broadcaster tooling.
Patch fingerprints
AI-assisted change f31eb893d712be48ebd6c02f69645938dc3f736ddad6676608c415e132b2284e · Fix 3dd437a2e58643b0405e14d608a7e7be19d734fecbb6654e6b09f1dbdf14fe01
Advisory references
- https://github.com/sgbett/bsv-ruby-sdk/security/advisories/GHSA-9hfr-gw99-8rhx
- https://nvd.nist.gov/vuln/detail/CVE-2026-40069
- https://github.com/sgbett/bsv-ruby-sdk/issues/305
- https://github.com/sgbett/bsv-ruby-sdk/pull/306
- https://github.com/sgbett/bsv-ruby-sdk/commit/4992e8a265fd914a7eeb0405c69d1ff0122a84cc
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bsv-sdk/CVE-2026-40069.yml
- https://github.com/sgbett/bsv-ruby-sdk
- https://github.com/sgbett/bsv-ruby-sdk/releases/tag/v0.8.2