From 839c76dca6cb8a43c96b02c34c194dab8f66dec0 Mon Sep 17 00:00:00 2001
From: Navid Rahimi <rahimi.nv@gmail.com>
Date: Sun, 23 Aug 2026 19:04:31 +0000
Subject: [PATCH] bls: Guard null contribution verification vector

---
 src/bls/bls_worker.cpp |  6 +++++-
 src/test/bls_tests.cpp | 20 ++++++++++++++++++++
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/src/bls/bls_worker.cpp b/src/bls/bls_worker.cpp
index 4e82327ed6..c940b0dc36 100644
--- a/src/bls/bls_worker.cpp
+++ b/src/bls/bls_worker.cpp
@@ -755,7 +755,11 @@ std::future<bool> CBLSWorker::AsyncVerifyContributionShare(const CBLSId& forId,
                                                            const BLSVerificationVectorPtr& vvec,
                                                            const CBLSSecretKey& skContribution)
 {
-    if (!forId.IsValid() || !VerifyVerificationVector(*vvec)) {
+    // vvec may be null when the verification vector for that member was never
+    // received (e.g. a non-member observer that did not get the member's QCONTRIB).
+    // Dereferencing it here is a remote-triggerable crash; treat a missing vvec as a
+    // failed verification, mirroring the null check in VerifyVerificationVectors().
+    if (!forId.IsValid() || vvec == nullptr || !VerifyVerificationVector(*vvec)) {
         auto p = BuildFutureDoneCallback<bool>();
         p.first(false);
         return std::move(p.second);
diff --git a/src/test/bls_tests.cpp b/src/test/bls_tests.cpp
index 96c73fc80d..23898e3b2a 100644
--- a/src/test/bls_tests.cpp
+++ b/src/test/bls_tests.cpp
@@ -4,6 +4,7 @@
 
 #include "bls/bls.h"
 #include "bls/bls_batchverifier.h"
+#include "bls/bls_worker.h"
 #include "test/test_bitcoin.h"
 
 #include <boost/test/unit_test.hpp>
@@ -154,4 +155,23 @@ BOOST_AUTO_TEST_CASE(batch_verifier_tests)
     Verify(msgs);
 }
 
+BOOST_AUTO_TEST_CASE(bls_verify_contribution_share_null_vvec_tests)
+{
+    CBLSWorker worker;
+    worker.Start();
+
+    const CBLSId id{uint256S("1")};
+    BOOST_REQUIRE(id.IsValid());
+
+    CBLSSecretKey sk;
+    sk.MakeNewKey();
+
+    const BLSVerificationVectorPtr nullVvec;
+    BOOST_REQUIRE(nullVvec == nullptr);
+
+    BOOST_CHECK(worker.AsyncVerifyContributionShare(id, nullVvec, sk).get() == false);
+
+    worker.Stop();
+}
+
 BOOST_AUTO_TEST_SUITE_END()