The BSV Ruby SDK’s ARC broadcasting component mistakenly interprets certain network responses—specifically those with txStatus values of INVALID, MALFORMED, MINED_IN_STALE_BLOCK, or any ORPHAN indicator—as successful broadcasts. This logical flaw, classified under CWE‑754, deceives applications that rely on the SDK’s success notification, allowing them to think a transaction has been accepted when it has not. Consequently, unvalidated or rejected transactions may be processed, leading to potential financial loss or unauthorized activity.

The vulnerability affects SGBett’s BSV Ruby SDK versions from 0.1.0 up through the release immediately before 0.8.2. The affected component is the ARC broadcast functionality within the SDK. Versions 0.8.2 and later include the fix.

With a CVSS score of 7.5 the flaw carries a high severity, although no EPSS data is available and it is not listed in CISA’s KEV catalog. The attacker can exploit the issue by triggering a transaction broadcast via the SDK while the network rejects it; the SDK’s incorrect success handling allows the attacker to bypass transaction validation. The attack vector is application‑side, relying on the SDK’s erroneous success indication without additional verification, making it particularly concerning for users who trust the SDK’s response.