Because eth-state-diff handles byte-level state transitions for the Ethereum consensus layer, vulnerabilities—such as out-of-bounds reads/writes, integer overflows, or logic errors in delta application—could lead to state corruption or consensus failures.

If you discover a security vulnerability, please do not open a public GitHub issue.

Instead, report it privately by emailing the maintainer at gbolahanf.14@gmail.com.

Please include the following in your report:

• A description of the vulnerability and its potential impact.
• Steps to reproduce the issue (e.g., malformed byte payloads, specific diff inputs).
• Any suggested fixes or mitigations.

You should expect an initial response within 48 hours. If the vulnerability is confirmed, we will work with you to coordinate a fix and disclosure.

This crate is designed to operate on untrusted byte payloads. We rely on explicit bounds checks rather than unwrap() or direct indexing for external data.

(Note: We are currently exploring designs to add cryptographic signatures to state diffs to further guarantee authenticity and integrity before application.)