PT-2024-18980 · Rust-Evm · Rust-Evm

Sorpaas

·

Published

2024-01-02

·

Updated

2024-01-09

·

CVE-2024-21629

CVSS v3.1

5.9

Medium

VectorAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions rust-evm versions prior to 0.41.1
Description The issue is related to the record external operation feature in rust-evm, which allows library users to record custom gas changes. This feature can have bogus interactions with the call stack, particularly during finalization of a CREATE or CREATE2. If the substack execution happens successfully, rust-evm will first commit the substate and then call record external operation(Write(out code.len())). If record external operation later fails, this error is returned to the parent call stack, instead of Succeeded. Yet, the substate commitment already happened, causing smart contracts to commit state changes when the parent caller contract receives zero address, which usually indicates that the execution has failed. This issue only impacts library users with custom record external operation that returns errors.
Recommendations For versions prior to 0.41.1, update to release 0.41.1 to resolve the issue. As a temporary workaround, consider disabling the record external operation feature until a patch is available. Restrict access to the record external operation function to minimize the risk of exploitation. Avoid using the record external operation function in the affected API endpoint until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-703

Related Identifiers

CVE-2024-21629
GHSA-27WG-99G8-2V4V

Affected Products

Rust-Evm