🔱 CB001 · PVE-AC Self-Referential Verification — Critical Attack Class · CLO-CONDITIONAL
ProgrammeCoinbase (HackerOne)
Assethttps://github.com/coinbase/cb-mpc — include/cbmpc/api/pve_batch_ac.h
Severity (class)Critical — Key compromise via PVE recovery path
Title (sibling)Self-referential verify() in PVE-AC aggregate_to_restore_row allows attacker-chosen key recovery
Original Issue#70 (CLOSED — need fresh variant CB001-B)
Attack ClassPVE-AC verification bypass — verify(Q, Q) passes for any consistent Q
Downstream ImpactSigning, withdrawals, API auth driven by attacker post-recovery
Theoremseparation_of_duties — verify(x,x)=true collapses access control to no-op
WLS58/100 — HOLD until sibling confirmed
POC TypeC++ unit test against public pve_batch_ac.h API · needs cb-mpc build
CLO StatusHOLD → CONDITIONAL SIGN on CB001-B confirmation
// CB001 — root cause pattern (issue #70, CLOSED):
// aggregate_to_restore_row() called verify() with Q from ciphertext itself:
verify(bundle.inner_Q, bundle.inner_Q) // self-referential
// Additionally: empty all_ac_pks skips verification entirely:
if (all_ac_pks.empty()) return true; // default permit bypass
// CB001-B sibling hunt — search for same pattern in:
// pve_base_pke.h restore path · HD keyset verify calls · TDH2 decrypt path
// grep: rg "verify\(" src/cbmpc/crypto/pve --type cpp -n
// grep: rg "all_ac_pks" src/cbmpc/ -rn