Lucene search

K
prionPRIOn knowledge basePRION:CVE-2023-42806
HistorySep 21, 2023 - 5:15 p.m.

Hardcoded credentials

2023-09-2117:15:00
PRIOn knowledge base
www.prio-n.com
8
hydra
cardano
hardcoded credentials
vulnerability
snapshot attack
patch planned

0.001 Low

EPSS

Percentile

41.5%

Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, not signing and verifying $\mathsf{cid}$ allows an attacker (which must be a participant of this head) to use a snapshot from an old head instance with the same participants to close the head or contest the state with it. This can lead to an incorrect distribution of value (= value extraction attack; hard, but possible) or prevent the head to finalize because the value available is not consistent with the closed utxo state (= denial of service; easy). A patch is planned for version 0.13.0. As a workaround, rotate keys between heads so not to re-use keys and not result in the same multi-signature participants.

CPENameOperatorVersion
hydralt0.13.0

0.001 Low

EPSS

Percentile

41.5%

Related for PRION:CVE-2023-42806