⚠️ Someone just posted a GitLab issue claiming PulseChain has a serious unpatched vulnerability that lets attackers permanently bloat the network. We dug into it. It doesn't hold up.
(original post/thread for context -
x.com/i/status/2061184032222…)
✍️ tl;dr for below? AI slop 'bug bounty' attempt, Opus 4.8 has picked it a,part below.
1/ The report says go-pulse v3.3.0 is "missing three upstream patches" from Ethereum: EIP-8032, EIP-8038, EIP-7612.
Problem: all three are still drafts. They're proposals for a future Ethereum upgrade. Ethereum mainnet doesn't have them either. You can't be missing patches that don't exist yet.
2/ One of them (EIP-7612) isn't even a fix for the problem described — it's the long-term plan to eventually replace Ethereum's entire state structure with Verkle Trees. Citing it as a "missing patch" misrepresents what it is.
3/ The core claim is that an attacker can write junk data to the chain, and even after they delete it, it stays on every node's hard drive forever — slowly killing performance.
This was true of old Ethereum software. It was fixed in geth v1.13 (Sept 2023) with a new storage system called PathDB. Geth v1.14 made it the default.
4/ On 1 Oct 2025,
@RichardHeartWin announced Go-Pulse v3.3.0 rebased from geth v1.13.13 to v1.16.3 — inheriting every state-management improvement Ethereum has shipped since.
5/ We had Claude repeatedly check the actual go-pulse source code to be certain. In core/rawdb/accessors_trie.go, the ParseStateScheme function explicitly defaults new nodes to PathDB:
"State schema set to default, scheme: path"
PulseChain didn't override the upstream default. The fix is active.
6/ The "proof of concept" code in the report actually has to manually force the old storage method (rawdb.HashScheme) to make the bug appear. A real v3.3.0 node doesn't use that method by default. The PoC is essentially demonstrating a bug in software no one runs.
7/ The underlying idea — that you can spam a blockchain with junk data to slow it down — is real and well known. It applies to every EVM chain, including Ethereum. PulseChain is no more vulnerable than mainnet.
8/ Bottom line: theoretical attack dressed up with scary-sounding invented terminology ("STATE-NURGLE") and citations to draft proposals as if they were missing fixes.
I am doing a security research audit of your blockcbain where do I submit any findings for bounty?