MAL-2025-20672 Malicious code in flare-smart-contracts (npm)

The package flare-smart-contracts was found to contain malicious code...

MAL-2025-18149 Malicious code in decentage-ico-contracts (npm)

The package decentage-ico-contracts was found to contain malicious code...

Malicious code in evm-cctp-contracts (npm)

The package evm-cctp-contracts was found to contain malicious code...

Malicious code in flare-smart-contracts (npm)

The package flare-smart-contracts was found to contain malicious code...

MAL-2025-19995 Malicious code in evm-cctp-contracts (npm)

The package evm-cctp-contracts was found to contain malicious code...

MAL-2025-18408 Malicious code in dexalot-contracts (npm)

The package dexalot-contracts was found to contain malicious code...

Malicious code in decentage-ico-contracts (npm)

The package decentage-ico-contracts was found to contain malicious code...

Malicious code in dexalot-contracts (npm)

The package dexalot-contracts was found to contain malicious code...

Malicious code in nexo-solidity-smart-contracts (npm)

The package nexo-solidity-smart-contracts was found to contain malicious code...

Malicious code in contracts-plugins (npm)

The package contracts-plugins was found to contain malicious code...

MAL-2025-17520 Malicious code in contracts-plugins (npm)

The package contracts-plugins was found to contain malicious code...

The Dark Side of Upgrades: Uncovering Security Risks in Smart Contract Upgrades

Smart contract upgrades are increasingly common due to their flexibility in modifying deployed contracts, such as fixing bugs or adding new functionalities. Meanwhile, upgrades compromise the immutability of contracts, introducing significant security concerns. While existing research has explore...

CVE-2025-54429

Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. There are various account address types in Frontier, e.g. precompiled contracts, smart contracts, and externally owned accounts. Some EVM mechanisms should be unreachable by certain types of accounts for...

Malicious Package

Overview axr-smart-contracts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Program Analysis for High-Value Smart Contract Vulnerabilities: Techniques

A widespread belief in the blockchain security community is that automated techniques are only good for detecting shallow bugs, typically of small value. In this paper, we present the techniques and insights that have led us to repeatable success in automatically discovering high-value smart...

CVE-2025-54429 Polkadot Frontier's constructing smart contract can bypass precompile address bounding

Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. There are various account address types in Frontier, e.g. precompiled contracts, smart contracts, and externally owned accounts. Some EVM mechanisms should be unreachable by certain types of accounts for...

CVE-2025-54429 Polkadot Frontier's constructing smart contract can bypass precompile address bounding

Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. There are various account address types in Frontier, e.g. precompiled contracts, smart contracts, and externally owned accounts. Some EVM mechanisms should be unreachable by certain types of accounts for...

Program Analysis for High-Value Smart Contract Vulnerabilities: Techniques and Insights

A widespread belief in the blockchain security community is that automated techniques are only good for detecting shallow bugs, typically of small value. In this paper, we present the techniques and insights that have led us to repeatable success in automatically discovering high-value smart...

Duplicate Advisory: CosmWasm affected by arithmetic overflows

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8724-5xmm-w5xq. This link is maintained to preserve external references. Original Description The cosmwasm-std crate before 2.0.2 for Rust allows integer overflows that cause incorrect contract calculations...

PT-2025-30549 · Undefined · Undefined

@FBI @CISAgov Federal systems remained unpatched against CVE-2025-35824—a critical SharePoint flaw exploited since July 19—when CISA’s emergency directive dropped 72 hours ago. Now the same agencies warning about ransomware can’t secure their own networks storing defense contracts and health...