CVE-2025-53359

ethereum is a common ethereum structs for Rust. Prior to ethereum crate v0.18.0, signature malleability according to EIP-2 was only checked for "legacy" transactions, but not for EIP-2930, EIP-1559 and EIP-7702 transactions. This is a specification deviation. The signature malleability itself is...

PT-2025-27657 · Unknown · Ethereum Crate

Name of the Vulnerable Software and Affected Versions: ethereum crate versions prior to 0.18.0 Description: The issue concerns a specification deviation in the ethereum crate for Rust, where signature malleability according to EIP-2 was only checked for "legacy" transactions, but not for EIP-2930...

Incorrect check for signature malleability

Lines of code Vulnerability details Impact Sig.recover has an Incorrect check: c.v != 27 || c.v != 28. Thus, Sig.recover always reverts. Proof of Concept c.v != 27 || c.v != 28 is always true function recoverbytes32 h, Components calldata c internal pure returns address // EIP-2 and malleable...