CVE-2024-34360

CVE-2024-34360 is a high-severity vulnerability affecting go-spacemesh, a Go implementation of the Spacemesh protocol full node, specifically versions prior to 1.5.2-hotfix1 and Spacemesh API prior to 1.37.1. This flaw allows malicious Smeshers to incorrectly reference an older Activation Transaction (ATX) in their chain, enabling them to receive rewards for holding Proof of Space-Time (PoST) data for less than the required duration. The vulnerability has a CVSS score of 8.2 (HIGH) due to its network-based attack vector, low attack complexity, and high impact on confidentiality (potential for illicit rewards). There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage regarding this CVE.