Uncaught Exception Affecting namada-apps package, versions <1.1.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-NAMADAAPPS-8745560
- published25 Feb 2025
- disclosed20 Feb 2025
- creditUnknown
Introduced: 20 Feb 2025
New CVE NOT AVAILABLE CWE-248 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade namada-apps to version 1.1.0 or higher.
Overview
Affected versions of this package are vulnerable to Uncaught Exception through the finalize_block process. An attacker can cause the ledger to crash by initializing a post-genesis validator with a negative commission rate using the --force flag. This is if the validator gets into the consensus set, then when computing PoS inflation inside fn update_rewards_products_and_mint_inflation, an instance of mul_floor returns an Err, causing the process to error.