PT-2025-29938 · Solady · Solady

Carlos-Cow · Published 2025-07-17 · Updated 2025-07-17 · CVE-2025-53638

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Solady versions 0.0.125 through 0.1.23

Description Solady is software that provides Solidity snippets with APIs. When an account is deployed via a proxy, using regular Solidity to call its initialization function may result in a silent failure if the initialization function does not return a bool or other return data. This occurs because regular Solidity uses extcodesize(proxy) to determine if the call succeeds, which is insufficient when the proxy points to an empty implementation.

Recommendations Upgrade to Solady version 0.1.24 or later. Deploy any affected implementations and their factories on new EVM chains as soon as possible.

Exploit

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2025-53638

GHSA-8XVX-4MVG-M9V8

Affected Products

Solady

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53638.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-53638 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53638 · Security Note
• https://github.com/Vectorized/solady/releases/tag/v0.1.24 · Note
• https://github.com/Vectorized/solady/security/advisories/GHSA-8xvx-4mvg-m9v8 · Note
• https://t.me/cvenotify/129337 · Telegram Post
• https://twitter.com/CVEnew/status/1945912149697786143 · Twitter Post
• https://t.me/cvetracker/28053 · Telegram Post