{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/701544#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nFireblocks' mpc-lib library contains a cryptographic fail-open vulnerability in its BIP32 hardened derivation implementation in the case of a missing private parent key. This breaks the ancestor isolation property of hardened derivation, allowing an attacker with a compromised lower-level signer share to recover the higher-level share it was derived from.\r\n\r\n### Description\r\n\r\nFireblocks is a digital-asset custody and wallet platform that secures the private keys behind cryptocurrency wallets for institutions and exchanges, using multi-party computation (MPC) so that no single machine ever holds a complete key.\r\n\r\nFireblocks’ key security pipeline contains two layers: MPC, which splits a single key into shares, and hardened derivation, which mathematically isolates each share from its key hierarchy. Normally, the derivation delta between parent and child keys is formed by hashing the private parent key, a derivation index, and associated metadata. \r\n\r\n**CVE-2026-90975** A fail-open vulnerability was identified within the BIP32 hardened derivation implementation which fails to reject operations where no parent secret is present. If a parent key is missing, the implementation substitutes the secret parent contribution with a null buffer. Because the buffer becomes a known constant, 0, the delta becomes computable, violating ancestor isolation. \r\n\r\n### Impact\r\nAn attacker who compromises a single MPC party's descendant signer share, and who knows the associated chain code, can compute the public derivation delta and subtract it to recover that party's ancestor share, repeating the operation up the hierarchy to obtain that party's root share. The isolation between derivation levels is reduced to a publicly computable scalar, so a single leaf-level share compromise extends to that party's shares across the entire key hierarchy managed by the MPC cluster.\r\n\r\nThe primary MPC secret-sharing layer still prevents reconstruction of a full private key from a single compromised party's shares, so this flaw does not by itself yield a spendable key. Its significance is the elimination of a defense-in-depth layer: hardened derivation no longer provides post-compromise ancestor isolation, threshold-security assumptions degrade as compromise propagates across derivation levels over time, and the downgrade occurs silently with no error or log signal. In BIP32 deployments where the chain code is treated as public, the precondition of knowing the chain code is trivially met.\r\n\r\n### Solution\r\nAt the time of writing, Fireblocks could not be reached to coordinate this vulnerability, and no vendor fix is available. Integrators can, however, reduce exposure with the following mitigations.\r\n\r\n* Treat the chain code as secret. The attack is only available to a party that knows the chain code, because the derivation delta is computed as HMAC-SHA512(chaincode, ...). Chain codes should not be distributed in watch-only extended public keys or otherwise exposed to untrusted parties. Where a deployment can keep the chain code confidential, the delta is no longer publicly computable and ancestor-share recovery is not possible. This is the most effective mitigation available without a code change.\r\n\r\n* Do not rely on hardened derivation for isolation between signer shares. Audit derivation paths for hardened segments and treat the compromise of any single share as potentially exposing that party's other shares across the derivation hierarchy.\r\n\r\nA complete fix requires a change in the library.\r\n\r\n### Acknowledgements\r\nThanks to hodlturk for reporting this vulnerability. This document was written using AI assisted tools by Alexander Curtis and Alex Lewis.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/701544"}],"title":"mpc-lib Hardened Derivation Fails to Protect Ancestor Isolation","tracking":{"current_release_date":"2026-10-26T22:45:54+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.51"}},"id":"VU#701544","initial_release_date":"2026-10-26 22:45:54.478084+00:00","revision_history":[{"date":"2026-10-26T22:45:54+00:00","number":"1.20261026224554.1","summary":"Released on 2026-10-26T22:45:54+00:00"}],"status":"final","version":"1.20261026224554.1"}},"vulnerabilities":[{"title":"mpc-lib in Fireblocks mpc-lib latest incorrectly substitutes a zero private key for the parent private key during hardened derivation, which allows an attacker with a single compromised descendant signer share to exactly compute the corresponding ancestor signer share(s) via scalar subtraction of a publicly reproducible derivation delta.","notes":[{"category":"summary","text":"mpc-lib in Fireblocks mpc-lib latest incorrectly substitutes a zero private key for the parent private key during hardened derivation, which allows an attacker with a single compromised descendant signer share to exactly compute the corresponding ancestor signer share(s) via scalar subtraction of a publicly reproducible derivation delta."}],"cve":"CVE-2026-90975","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#701544"}]}],"product_tree":{"branches":[]}}