PT-2024-26119 · Unknown · Era-Compiler-Solidity

Hedgar2017 · Published 2024-05-13 · Updated 2024-05-14 · CVE-2024-34704

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions era-compiler-solidity versions prior to 1.4.1

Description The issue occurs during the DAGCombine phase while visiting the XOR operation, specifically when attempting to fold the expression !(x cc y) into (x !cc y). This transformation should be skipped because the correct representation of the true value is 1, not -1.

Recommendations For versions prior to 1.4.1, update to version 1.4.1 to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-682

Related Identifiers

CVE-2024-34704

GHSA-22PJ-7CVW-R3GC

Affected Products

Era-Compiler-Solidity

References · 4

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34704.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-34704 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34704 · Security Note
• https://github.com/matter-labs/era-compiler-solidity/security/advisories/GHSA-22pj-7cvw-r3gc · Note