Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

soroban-env-host

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 1.7crates.ioPublished

    Soroban: Muxed address ScVal conversions may break after a conversion failure

    GHSA-pm4j-7r4q-ccg8

    Affected
    • crates.io soroban-env-host < 26.0.0
    Fixed in
    26.0.0· Vendor fix available
    Issue
    Soroban host ensures that MuxedAddress objects can't be used as storage keys in order to proactively prevent the contract logic bugs. However, due to a bug in Soroban host implementation, a failure in Val-ScVal conversion during the storage key computation will have the flag indicating that storage conversion is happening stuck in the true state until the next storage access. While the flag is stuck in true state, any MuxedAddress object conversions to ScVal will fail, i.e. a failure will occur if a MuxedAddress is emitted in the event or is serialized to XDR via a host function. Impact The bug may cause unexpected contract failures in the rare edge case scenarios. In the worst case scenario the whole transaction will fail and the changes will be rolled back. Because the contract call is simply rolled back, there is no risk of the state corruption. An example scenario that would be affected by the bug is as follows: - Contract A calls contract B via trycall - Contract B calls…

    Recommended action: Upgrade to 26.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →