AFBSBlockchain & Security
EN
FrançaisFR EnglishEN 中文ZH

Security advisory · 30 October 2026

Conceal:
a DNS checkpoint can fake the whole chain.

Conceal (CryptoNote / Karbo) loads checkpoints from a plain DNS TXT record. Inside the covered zone, the node no longer verifies PoW or signatures. An attacker who controls DNS or the network path can therefore make a forged chain accepted, without hashpower or a private key. The risk is critical for nodes and integrators.

CriticalConsensusDNSCryptoNote

CONCEAL-CONSENSUS-2026-01 · v1.0 · 30 October 2026 · ~5 min read

Summary

Conceal is a CryptoNote chain (Karbo branch). The report identifies a critical weakness in checkpoint loading and in validation of past blocks. Checkpoints are retrieved from a plain DNS TXT record; DNSSEC is not enforced.

Inside the zone covered by the latest known checkpoint, the node no longer verifies PoW or input signatures. An attacker able to inject a DNS response or modify the network path can therefore present a forged chain as valid. No hashpower or private key is required.

What was found

  • Checkpoints are loaded from plain DNS TXT records, without DNSSEC.
  • They are loaded at startup and again while processing alternative blocks.
  • Inside the “checkpoint zone”, PoW verification is replaced by a simple hash comparison.
  • In the same zone, input and multisignature checks are skipped.
  • Injected heights have no strict consistency bound.

Impact

A node can accept a forged chain, relay invalid transactions and present a state that does not match the real chain. New nodes are especially exposed: during initial sync they can remain inside the checkpoint zone for the entire synchronization.

This is not direct private-key theft: it is an attack on chain integrity and consensus validation. For an integrator, exchange or node operator, the impact remains critical.

Scope and limitations

  • Static review of the ConcealNetwork/conceal-core snapshot; no build and no dynamic test.
  • No network PoC was executed; offensive steps are not published.
  • The full report, evidence and code lines remain restricted.
  • Other Conceal products, wallets and third-party services are not covered.

Recommendations

  • Never load a checkpoint from an unauthenticated channel; use signed, embedded checkpoints.
  • Treat DNS only as a hint, with mandatory DNSSEC; never as a trust root.
  • Never skip PoW or signature verification because a block is inside the checkpoint zone.
  • Bound injected heights and reject regressions or conflicts with known points.
  • Plan a migration and an independent review of the consensus path before resuming.

Disclosure

For operators, integrators and security teams: security@frblockchain.icu. Do not send private keys, seeds or exploitation secrets.

A Conceal node to verify, a chain to validate?

Contact the security team All reports