CVE-2026-62162

Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the Claim branch in hydra-plutus/validators/deposit.ak checks only that datum.headid matches the attacker-controlled redeemer.currencySymbol and that the transaction is valid before the deposit deadline. It neither requires...

CVE-2026-62162

The Hydra layer-two scalability solution for Cardano is vulnerable in versions prior to 2.1.0 due to a missing invariant in the Claim branch of hydra-plutus/validators/deposit.ak. The validator fails to require spending the Head state-token UTxO within the same transaction and lacks output constr...

CVE-2026-62162 Hydra: Deposit Claim omits Head state-token spending requirement

Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the Claim branch in hydra-plutus/validators/deposit.ak checks only that datum.headid matches the attacker-controlled redeemer.currencySymbol and that the transaction is valid before the deposit deadline. It neither requires...

EUVD-2026-114282

Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the Claim branch in hydra-plutus/validators/deposit.ak checks only that datum.headid matches the attacker-controlled redeemer.currencySymbol and that the transaction is valid before the deposit deadline. It neither requires...

CVE-2026-62162: cardano-scaling hydra: Hydra is a layer-two scalability solution for Cardano

Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the Claim branch in hydra-plutus/validators/deposit.ak checks only that datum.headid matches the attacker-controlled redeemer.currencySymbol and that the transaction is valid before the deposit deadline. It neither requires...