GHSA-2gw2-qgjg-xh6p

Source

https://github.com/advisories/GHSA-2gw2-qgjg-xh6p

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-2gw2-qgjg-xh6p/GHSA-2gw2-qgjg-xh6p.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2gw2-qgjg-xh6p

Published

2025-02-20T20:24:19Z

Modified

2025-02-20T20:24:19Z

Summary

Namada-apps allows Post-Genesis Validator Bypass

Details

Impact

Ledger crash. A user is able to initialize a post-genesis validator with a negative commission rate using the --force flag. If this validator gets into the consensus set, then when computing PoS inflation inside fn update_rewards_products_and_mint_inflation, an instance of mul_floor will cause the return of an Err, which causes finalize_block to error.

Patches

This issue has been patched in apps version 1.1.0. The PoS validity predicate now enforces that the commission rate is not negative and any transaction that fails the check will be rejected, both for newly initialized validators and for commission rate change of an existing validator.

Workarounds

There are no workarounds and users are advised to upgrade.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-248"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2025-02-20T20:24:19Z"
}

References

Affected packages

crates.io / namada-apps

Package

Name: namada-apps; View open source insights on deps.dev
Purl: pkg:cargo/namada-apps

Affected ranges

Type: SEMVER
Events: Introduced

1.0.0

Fixed

1.1.0

Affected versions

1.*

1.0.0