CVE-2023-34449

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-34449
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-34449.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-34449
Aliases
Published
2023-06-14T20:10:54.842Z
Modified
2026-05-28T03:53:59.769471705Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
ink! vulnerable to incorrect decoding of storage value when using `DelegateCall`
Details

ink! is an embedded domain specific language to write smart contracts in Rust for blockchains built on the Substrate framework. Starting in version 4.0.0 and prior to version 4.2.1, the return value when using delegate call mechanics, either through CallBuilder::delegate or ink_env::invoke_contract_delegate, is decoded incorrectly. This bug was related to the mechanics around decoding a call's return buffer, which was changed as part of pull request 1450. Since this feature was only released in ink! 4.0.0, no previous versions are affected. Users who have an ink! 4.x series contract should upgrade to 4.2.1 to receive a patch.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34449.json",
    "cwe_ids": [
        "CWE-253",
        "CWE-754"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/use-ink/ink

Affected ranges

Type
GIT
Repo
https://github.com/use-ink/ink
Events
Introduced
ad4f5e579e39926704e182736af4fa945982ac2b
Fixed
1b2e7cfe24ee2844804e77fad601b996641fe6f1

Affected versions

v4.*
v4.0.0
v4.0.1
v4.1.0
v4.2.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-34449.json"