Improper Validation of Specified Quantity in Input Affecting kora-lib package, versions <2.0.5
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-KORALIB-15669337
- published16 Mar 2026
- disclosed12 Mar 2026
- creditsolanabughunter-glitch
Introduced: 12 Mar 2026
New CVE NOT AVAILABLE CWE-1284 (opens in a new tab)How to fix?
Upgrade kora-lib to version 2.0.5 or higher.
Overview
Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the verify_token_payment function. An attacker can cause systematic financial loss to the paymaster by exploiting the discrepancy between the credited payment value and the actual amount received after transfer fees are deducted on-chain.
Note: This is only exploitable if a Token-2022 token with a TransferFeeConfig extension is whitelisted in the allowed SPL paid tokens.