AIKIDO-2026-10501

TL;DR

Affected versions of this package are affected by an improper validation flaw in evidence handling, where Byzantine validator entries could have their public keys swapped while retaining the original validator addresses. It could cause misbehavior reports to be redirected toward the wrong validator or allow malicious actors to interfere with accountability during evidence verification. An attacker controlling sufficient Byzantine validators could craft forged evidence with mismatched address/pubkey pairs so the system misattributes consensus faults, potentially disrupting slashing, incident response, or other validator punishment logic. The fix enforces that each validator’s public key correctly matches its address before accepting the evidence.