PT-2023-24884 · Ink! · Ink!

Facundo Lerena · Published 2023-06-14 · Updated 2023-06-28 · CVE-2023-34449

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ink! versions 4.0.0 through 4.2.1

Description The return value when using delegate call mechanics, either through CallBuilder::delegate or ink env::invoke contract delegate, is decoded incorrectly. This issue is related to the mechanics around decoding a call's return buffer, which was changed as part of pull request 1450. No previous versions are affected since this feature was only released in ink! 4.0.0. An analysis of on-chain deployments of ink! contracts on several chains found no contracts affected by the issue.

Recommendations For ink! versions 4.0.0 through 4.2.1, upgrade to version 4.2.1 to receive a patch.

Exploit

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

CWE-253

Related Identifiers

CVE-2023-34449

GHSA-853P-5678-HV8F

Affected Products

Ink!

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34449.json · Exploit
• 🔥 https://github.com/paritytech/ink/security/advisories/GHSA-853p-5678-hv8f · Exploit
• 🔥 https://docs.rs/ink_env/4.2.0/ink_env/fn.invoke_contract_delegate.html · Exploit
• 🔥 https://docs.rs/ink_env/4.2.0/ink_env/call/struct.CallBuilder.html#method.delegate · Exploit
• https://github.com/paritytech/ink/commit/f1407ee9f87e5f64d467a22d26ee88f61db7f3db · Patch
• https://github.com/paritytech/ink/pull/1450 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34449 · Security Note
• https://osv.dev/vulnerability/GHSA-853p-5678-hv8f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-34449 · Vendor Advisory
• https://github.com/paritytech/ink · Note
• https://t.me/cvenotify/52357 · Telegram Post