Uncaught Exception Affecting orml-rewards package, versions <1.2.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-ORMLREWARDS-8730857
- published16 Feb 2025
- disclosed14 Feb 2025
- creditUnknown
Introduced: 14 Feb 2025
CVE NOT AVAILABLE CWE-248 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade orml-rewards to version 1.2.1 or higher.
Overview
Affected versions of this package are vulnerable to Uncaught Exception through the add_share function. An attacker can cause a runtime panic and potentially crash the node process by submitting a specially crafted extrinsic that includes an input exceeding the u128 range. This is only exploitable if there exists at least one rewards pool where reward tokens exceed twice the collateral tokens, allowing sufficiently large multiplication to exceed u128 bounds.