Log in Start free

input-output-hk

Products

ProductCVEsExploitedLatest
hydra4–Oct 4, 2023

Exploited and recent CVEs

  • CVE-2023-42449 High 8.1 Malicious head initialiser can extract PTs from control of Hydra scripts, leading to locked participant commits or spoofed commits 1.1%
  • CVE-2023-42448 High 8.1 Hydra's contestation period in head datum can be modified during Close transaction, allowing malicious participant to freely modify the contestation deadline 1.0%
  • CVE-2023-38701 Critical 9.1 Hydra's committed UTxOs at Commit validator and UTxOs at Initial validator can be spent arbitrarily by anyone 1.1%
  • CVE-2023-42806 Medium 6.5 Snapshot signature not including HeadID will allow replay attacks 0.5%