CVE-2023-42448

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2023-42448

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-42448.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2023-42448

Aliases

GHSA-mgcx-6p7h-5996

Published

2023-10-04T18:57:52.752Z

Modified

2025-12-09T12:03:11.981665Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator

Summary

Hydra's contestation period in head datum can be modified during Close transaction, allowing malicious participant to freely modify the contestation deadline

Details

Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, the specification states that the contestation period in the datum of the UTxO at the head validator must stay unchanged as the state progresses from Open to Closed (Close transaction), but no such check appears to be performed in the checkClose function of the head validator. This would allow a malicious participant to modify the contestation deadline of the head to either allow them to fanout the head without giving another participant the chance to contest, or prevent any participant from ever redistributing the funds locked in the head via a fan-out. Version 0.13.0 contains a patch for this issue.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-20"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42448.json"
}

References

Affected packages

Git / github.com/cardano-scaling/hydra

Affected ranges

Type: GIT
Repo: https://github.com/cardano-scaling/hydra
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

2f45529729e28254a62f7a7c8d6649066923ed1f

Affected versions

0.*

0.1.0

0.10.0

0.11.0

0.12.0

0.2.0

0.3.0

0.4.0

0.5.0

0.6.0

0.7.0

0.8.0

0.8.1

0.9.0

plutus-cbor-1.*

plutus-cbor-1.0.0

plutus-merkle-tree-1.*

plutus-merkle-tree-1.0.0

Git / github.com/input-output-hk/hydra