Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@ensdomains/ens-contracts

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.9npmAmendedPublished

    .eth registrar controller can shorten the duration of registered names

    CVE-2023-38698 · GHSA-rrxv-q8m4-wch3

    Affected
    • npm @ensdomains/ens-contracts <= 0.0.21
    Fixed in
    0.0.22· Vendor fix available
    Issue
    According to the documentation, controllers are allowed to register new domains and extend the expiry of existing domains, but they cannot change the ownership or reduce the expiration time of existing domains. However, a preliminary analysis suggests that an attacker-controlled controller may be able to reduce the expiration time of existing domains due to an integer overflow in the renew function. The vulnerability resides in the following GitHub repository: https://github.com/ensdomains/ens-contracts/blob/master/contracts/ethregistrar/BaseRegistrarImplementation.sol#L171 The vulnerable line of code is: In this code snippet, the duration variable is user-supplied, making it possible to provide a value that would cause an overflow on both sides of the '' expression, ultimately rendering the condition true. Specifically, when the duration is set to 2^256 - GRACEPERIOD, the subsequent line expiries[id] += duration; also experiences an overflow, as expiries[id] is greater…

    Recommended action: Upgrade to 0.0.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →