Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
When a user pays transaction fees using a Token-2022 token with a TransferFeeConfig extension, Kora's verifytokenpayment() credits the full raw transfer amount as the payment value. However, the on-chain SPL Token-2022 program withholds a portion of that amount as a transfer fee, so the paymaster's destination account only receives amount - transferfee. This means the paymaster consistently credits more value than it actually receives, resulting in systematic financial loss. Severity High Affected Component - File: crates/lib/src/token/token.rs - Function: verifytokenpayment() - Lines: 529–654 (specifically 633–639) Root Cause In verifytokenpayment(), the amount extracted from the parsed SPL transfer instruction is the pre-fee amount (what the sender specifies in the transferchecked instruction). The function passes this raw amount to calculatetokenvalueinlamports() to determine how many lamports the payment is worth. It never subtracts the Token-2022 transfer fee. The fee…
Recommended action: Upgrade to 2.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When inner CPI instructions use instruction types not recognized by Kora's parser (including Token-2022 extension instructions like ConfidentialTransfer, TransferFeeExtension::WithdrawWithheldTokens, etc.), they are reconstructed as stub instructions with empty accounts and empty data. These stubs fail deserialization during fee payer policy validation and are silently skipped, meaning any fee payer usage within those instructions goes completely unchecked. Severity Medium Affected Component - File: crates/lib/src/transaction/instructionutil.rs - Functions: reconstructsysteminstruction(), reconstructspltokeninstruction() - Lines: 750–753, 1187–1189 Root Cause The instruction reconstruction functions have a catch-all = arm for unrecognized instruction types that creates a stub CompiledInstruction with the correct programidindex but empty accounts and empty data. When this stub reaches the fee payer policy parsing (parsesysteminstructions / parsetokeninstructions),…
Recommended action: Upgrade to 2.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.