Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

mpl-candy-machine

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Unratedcrates.ioPublished

    Candy Machine Set Collection During Mint Missing Check

    GHSA-9v25-r5q2-2p6w

    Affected
    • crates.io mpl-candy-machine >= 4.5.0, <= 4.5.0
    Fixed in
    4.5.1· Vendor fix available
    Issue
    A problem with Candy Machine V2 allow minting NFTs to an arbitrary collection due to a missing check. Here is a description of the exploit: Details: Here is the tx/ix to exploit: Transaction: Ix 1: candymachine v2, mintnft, passing in empty metadata -1 Ix 2: custom handler, 0 cpi A -- tokenmetadata createmetadataaccount, creates NFT cpi B -- candymachine v2, setcollectionduringmint Ix 1 passes our first check for empty metadata, but eventually will hit a bot tax and return Ok. We do have a CPI check in this function but even if we hit that or moved it to the top, it returns Ok as a bot tax and still enables the issue. Ix 2, cpi A is Ok and mints an arbitrary NFT. Ix 2, cpi B checks the previous instruction using indexrelativetocurrent-1. This turns out to be Ix 1 which was Ok, so then your newly minted arbitrary NFT is successfully added to the collection. Conclusion: Candy machine could be out of NFTs and it still works. If the CM is closed, (we think?) it doesn't get to the check.…

    Recommended action: Upgrade to 4.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →