Vulnerability · Published Jun 14, 2023 · Assigned by GitHub_M

CVE-2023-34449ink! vulnerable to incorrect decoding of storage value when using `DelegateCall`

Medium 5.3

In plain English

A medium-severity security flaw in ink from paritytech. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)1.0%top 38.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

ink! is an embedded domain specific language to write smart contracts in Rust for blockchains built on the Substrate framework. Starting in version 4.0.0 and prior to version 4.2.1, the return value when using delegate call mechanics, either through `CallBuilder::delegate` or `ink_env::invoke_contract_delegate`, is decoded incorrectly. This bug was related to the mechanics around decoding a call's return buffer, which was changed as part of pull request 1450. Since this feature was only released in ink! 4.0.0, no previous versions are affected. Users who have an ink! 4.x series contract should upgrade to 4.2.1 to receive a patch.

Affected products (as reported)

Vendor	Product	Versions
paritytech	ink	>= 4.0.0, < 4.2.1

Weakness: CWE-754, CWE-253 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/paritytech/ink/security/advisories/GHSA-853p-5678-hv8f x_refsource_CONFIRM
https://github.com/paritytech/ink/pull/1450 x_refsource_MISC
https://github.com/paritytech/ink/commit/f1407ee9f87e5f64d467a22d26ee88f61db7f3db x_refsource_MISC
https://docs.rs/ink_env/4.2.0/ink_env/call/struct.CallBuilder.html#method.delegate x_refsource_MISC
https://docs.rs/ink_env/4.2.0/ink_env/fn.invoke_contract_delegate.html x_refsource_MISC