BSV TIMES

BSV Rust Toolkit Patches Flaw That Could Restore an Attacker’s Key

BSV Rust Toolkit Patches Flaw That Could Restore an Attacker’s Key
, ,

Developer Tools / Wallets & Identity

In Brief

The bsv-rs development toolkit has fixed a flaw that could make an application restore an attacker’s private key from a tampered split backup. The fix is included in stable version 0.8.8, which also corrects a separate problem that could cause an application to identify the wrong transaction.

News Report

Both updates were published on November 12 (UTC): the backup fix in version 0.8.7 and the transaction fix in 0.8.8. bsv-rs is a software library for developers building BSV applications in Rust. The advisories concern applications using its affected functions.

Why Backup Recovery Needed a Fix

A split backup divides the information needed to recover a private key into several shares. A minimum number must be brought together to restore the key, allowing those shares to be kept separately.

According to the project’s advisory, an attacker who could supply a specially prepared share to the recovery process could make the affected software return a key the attacker already knew. If an application then used that result as its wallet key, funds subsequently received on it could be at risk.

The fix checks the supplied shares and rejects invalid sets before reconstructing a key. Valid backups generated by the toolkit remain readable. RustSec lists the backup vulnerability as critical.

A Second Fix for Transaction Bundles

Version 0.8.8 also addresses BEEF, a format for sending transactions with supporting history and proofs. Under a particular incomplete-history condition, the toolkit could write a bundle with the wrong transaction at the end. An application reading that bundle without specifying the transaction it expected could then receive another transaction from the same bundle.

The update keeps the intended transaction in the expected position. Reads that explicitly identify the expected transaction were not affected.

What Is Available

Version 0.8.8 is published on crates.io, Rust’s package registry, and contains both fixes. The backup issue affects stable versions 0.2.0 through 0.8.6; the transaction issue extends through 0.8.7.

Both advisories also cover 0.9.0-beta.1 through 0.9.0-beta.7. At the time of checking, no patched 0.9.0 beta had been published. The project says the next beta will include the fixes.

The release notes report regression tests that reproduced the earlier failures and passed after the fixes.

BSV TIMES Read

The practical issue is trust in recovery and transaction records: software can return a valid-looking result that is still the wrong one. Publishing fixes and advisories gives developers a concrete basis for updating affected applications.

The disclosures describe software flaws and their repairs. They do not identify an exploited consumer wallet or establish how many deployed applications use the affected functions.

Developer Context

bsv-rs is hosted under the Calhooon GitHub organization. It provides Rust tools for cryptography, transactions, wallet functions, authentication and overlay services. Both advisories credit the project’s own review work with finding the flaws.

Source Links

Posted on November 13, 2026 (UTC)

Leave a Reply