Vulnerability · Published Jul 17, 2025 · Assigned by GitHub_M

CVE-2025-53638Solady lacks extcodesize validation on implementation in ERC4337Factory

Medium 6.9

In plain English

A medium-severity security flaw in solady from Vectorized. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.4%top 70.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Solady is software that provides Solidity snippets with APIs. Starting in version 0.0.125 and prior to version 0.1.24, when an account is deployed via a proxy, using regular Solidity to call its initialization function may result in a silent failure, if the initialization function does not return a `bool` or some other return data. This is because regular Solidity uses `extcodesize(proxy)` to decide if call succeeds. This is insufficient in the case when the proxy points to an empty implementation. Users should upgrade to Solady v0.1.24 or later to receive a patch. Deploy any affected implementations and their factories on new EVM chains as soon as possible.

Affected products (as reported)

Vendor	Product	Versions
Vectorized	solady	>= 0.0.125, < 0.1.24

Weakness: CWE-754 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/Vectorized/solady/security/advisories/GHSA-8xvx-4mvg-m9v8 x_refsource_CONFIRM
https://github.com/Vectorized/solady/releases/tag/v0.1.24 x_refsource_MISC