Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

ink

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3crates.ioPublished

    ink! vulnerable to incorrect decoding of storage value when using DelegateCall

    CVE-2023-34449 · GHSA-853p-5678-hv8f

    Affected
    • crates.io ink >= 4.0.0, < 4.2.1
    Fixed in
    4.2.1· Vendor fix available
    Issue
    The return value when using delegate call mechanics, either through CallBuilder::delegate or inkenv::invokecontractdelegate, is being decoded incorrectly. Description Consider this minimal example: In this example we are executing the Callee code in the context of the Caller contract. This means we'll be using the storage values of the Caller contract. Running this code we expect the delegate call to return value as it was stored in the Caller contract. However, due to the reported bug a different value is returned (for the case of uints it is 256 times the expected value). Impact After conducting an analysis of the on-chain deployments of ink! contracts on Astar, Shiden, Aleph Zero, Amplitude and Pendulum, we have found that no contracts on those chains have been affected by the issue. This bug was related to the mechanics around decoding a call's return buffer, which was changed as part of https://github.com/paritytech/ink/pull/1450. Since this feature was only released in…

    Recommended action: Upgrade to 4.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →