Inside CertiK's Independent Security Research on Besu

CertiK used a chaos-engineering adversarial testnet to find five resource-exhaustion (denial-of-service) vulnerabilities in the Besu Ethereum client—two Major—that allowed unprivileged peers or JSON-RPC/WebSocket clients to trigger unbounded thread or memory growth, crash nodes, or stall consensus; Besu released fixes in version 26.7.1 and published advisories after coordinated disclosure.