Vulnerability · Published Jul 28, 2025 · Assigned by GitHub_M

CVE-2025-54426Polkadot Frontier contains silent failure in Curve25519 arithmetic precompiles with malformed points

Critical 9.9

In plain English

A critical-severity broken cryptography in frontier from polkadot-evm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 4.0)9.9Critical

Exploit odds (30 days)0.4%top 69.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. In versions prior to commit 36f70d1, the Curve25519Add and Curve25519ScalarMul precompiles incorrectly handle invalid Ristretto point representations. Instead of returning an error, they silently treat invalid input bytes as the Ristretto identity element, leading to potentially incorrect cryptographic results. This is fixed in commit 36f70d1.

Affected products (as reported)

Vendor	Product	Versions
polkadot-evm	frontier	< 36f70d1

Weakness: CWE-327 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:H/SA:N

References

https://github.com/polkadot-evm/frontier/security/advisories/GHSA-v4q3-23rh-w5mw x_refsource_CONFIRM
https://github.com/polkadot-evm/frontier/pull/1720/commits/8ed6053fb868495477ba2409f7e64f439df76f96 x_refsource_MISC
https://github.com/polkadot-evm/frontier/commit/36f70d1defcaeaed5a453015f6c98c21bb5b121b x_refsource_MISC
https://dotpal.io/assets/files/frontier-srlabs-2505-718c3bfa5df9fed1862fed05de506859.pdf x_refsource_MISC