Lior Ben Moha

Security researcher and software engineer working across AI, protocol, and distributed-systems security.

View research LinkedIn

Lior Ben Moha overlooking a mountain landscape

Current focus Building secure systems. Finding what matters.

Security, systems and trust.

Selected security work / 02

Validated findings.

Two medium-severity reports across protocol and validator infrastructure. Each began with a trust assumption that held in one component and failed in the next.

NEAR Protocol / HackenProof / 2026 When one transaction has two outcomes. A transaction succeeded on-chain while its canonical outcome proof said it failed. SeverityMedium ResultValid

Failure path

Input 01Signed TX AExecutes
Input 02Signed TX AInvalidNonce
Storage keySame outcome IDHash collision
Canonical proofFailure winsState effects remain

Invariant

An executed transaction and its canonical outcome proof must agree.

What failed

A malicious chunk producer could include the same signed transaction twice. Both outcomes used the transaction hash as their ID, allowing the later failure to overwrite the earlier success in canonical storage.

Impact

RPC clients, indexers, wallets, exchanges, relayers, and light-client systems could observe a valid failure proof for a transaction whose state effects had already occurred.

Firedancer v1 / Immunefi audit competition / 2026 An entrypoint shortcut redirected repair traffic. A zero-stake attacker could enter CRDS as a trusted entrypoint and steer a validator's signed repair requests. SeverityMedium ResultValid

Trust cascade

Remote peerContactInfoAddress claimed
Gossip gateEntrypoint matchPing bypassed
Shared stateCRDS acceptsRouting trusted
Repair tileTraffic steeredLeader liveness

Invariant

A signed contact record does not prove the network reachability of every address it advertises.

What failed

Firedancer treated an advertised socket matching a configured entrypoint as proof of trust. Attacker-controlled repair addresses then crossed from gossip admission into repair-peer selection.

Measured evidence