CVE-2023-42448highCWE-20

CVE-2023-42448: high-severity vulnerability in input-output-hk hydra

Hydra's contestation period in head datum can be modified during Close transaction, allowing malicious participant to freely modify the contestation deadline

Published · Updated

Follow this CVE+ Monitor hydra

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 1.0%
Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, the specification states that the contestation period in the datum of the UTxO at the head validator must stay unchanged as the state progresses from Open to Closed (Close transaction), but no such check appears to be performed in the `checkClose` function of the head validator. This would allow a malicious participant to modify the contestation deadline of the head to either allow them to fanout the head without giving another participant the chance to contest, or prevent any participant from ever redistributing the funds locked in the head via a fan-out. Version 0.13.0 contains a patch for this issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Affected products
input-output-hk · hydra
Related CVEs — input-output-hk hydra

In the same product, most dangerous first.

CVE-2023-42449HIGHMalicious head initialiser can extract PTs from control of Hydra scripts, leading to locked participant commits or spoofed commitsEPSS 1.1%CVE-2023-38701CRITICALHydra's committed UTxOs at Commit validator and UTxOs at Initial validator can be spent arbitrarily by anyoneEPSS 1.1%CVE-2023-42806MEDIUMSnapshot signature not including HeadID will allow replay attacksEPSS 0.5%