[SECURITY] Critical: Missing BLS12-381 subgroup validation + WRAPS threshold fork in hiero-cryptography

[mnur9868]

Security Vulnerability Report — 2 CRITICAL findings

GitHub Security Advisories have been filed with full details and PoC:

1. Missing BLS12-381 Subgroup Validation (GHSA-r6vg-959p-vx2q)

• File: jni_util.rs:80 — T::deserialize_uncompressed() no subgroup check
• Affected: verifyBls (jni_hints.rs:232), verifyBlsBatch (jni_hints.rs:283), aggregateSignatures (jni_hints.rs:344)
• Safe path: jni_bls.rs:159/191 DOES check subgroup
• Impact: Signature repudiation / aggregate corruption
• Advisory: https://github.com/mnur9868/hiero-cryptography/security/advisories/GHSA-r6vg-959p-vx2q

2. WRAPS Threshold Non-Strict (GHSA-2hcj-qh5r-g924)

• File: wraps/src/lib.rs:977 — > allows exactly 1/2 weight
• HinTS counterpart: hints.rs:796-799 uses strict > (with comment explaining why)
• Impact: Network fork via dual valid address book rotations
• Advisory: https://github.com/mnur9868/hiero-cryptography/security/advisories/GHSA-2hcj-qh5r-g924

Reproduction

Both PoCs are available in the advisory attachments and are reproducible locally.

Per Hiero Security Policy, please acknowledge within 2 business days.

Reporter: @mnur9868

[kekubhai]

Thanks @mnur9868 for the detailed report and PoCs. I've reviewed both advisories and would like to help with the remediation if maintainers are accepting external contributions on this.