PT-2025-49170 · Taiko · Taiko Alethia

Published 2025-12-04 · Updated 2025-12-05 · CVE-2025-66559

Positive Technologies (AI Summary)

CVSS v4.0

8.0

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions Taiko Alethia versions prior to 2.3.1

Description Taiko Alethia, a permissionless rollup designed to scale Ethereum, contains an issue in the TaikoInbox. verifyBatches function (packages/protocol/contracts/layer1/based/TaikoInbox.sol:627-678). The function incorrectly advances the local transaction ID (tid) to a transition matching the current block hash before verifying the batch. If the verification loop breaks due to conditions like a cooldown window or an invalidated transition, the function still writes the newer tid into batches[lastVerifiedBatchId].verifiedTransitionId after decrementing the batch ID. This can cause the last verified batch to point to a transition index from the next batch, potentially corrupting the verified chain pointer.

Recommendations Update to version 2.3.1 or later.

Exploit

Fix

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

CVE-2025-66559

GHSA-5MXH-R33P-6H5X

Affected Products

Taiko Alethia

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66559.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-66559 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66559 · Security Note
• https://github.com/taikoxyz/taiko-mono/commit/379f5cb4ffe9e1945563ab2c7740bc9f4ea004d8 · Note
• https://github.com/taikoxyz/taiko-mono/security/advisories/GHSA-5mxh-r33p-6h5x · Note
• https://t.me/cveNotify/144814 · Telegram Post
• https://twitter.com/CVEnew/status/1996713922645148020 · Twitter Post
• https://t.me/CVEtracker/38880 · Telegram Post