CVE-2025-21607

The CVE-2025-21607 issue affects the Vyper Pythonic smart contract language compiler when using precompiles EcRecover (0x1) and Identity (0x4); the success flag of those calls isn’t checked, allowing an attacker to allocate gas to cause a precompile to fail while the rest of execution continues, ...

CVE-2025-21607 Success of Certain Precompile Calls not Checked in Vyper

Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompiles EcRecover 0x1 and Identity 0x4, the success flag of the call is not checked. As a consequence an attacker can provide a specific amount of gas to make these calls fail but let the overall executi...

Vyper Does Not Check the Success of Certain Precompile Calls

Summary When the Vyper Compiler uses the precompiles EcRecover 0x1 and Identity 0x4, the success flag of the call is not checked. As a consequence an attacker can provide a specific amount of gas to make these calls fail but let the overall execution continue. Then the execution result can be...

CVE-2025-21607: Always-Incorrect Control Flow Implementation

Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompiles EcRecover 0x1 and Identity 0x4, the success flag of the call is not checked. As a consequence an attacker can provide a specific amount of gas to make these calls fail but let the overall executi...

MAL-2024-11413 Malicious code in orderly-evm-crosschain (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in orderly-evm-crosschain (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-10604 Malicious code in @david-lab/evm-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da15cab58cbaaf01db60d8e67007017a770017bc33db5b17508dcd03db50b1a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @david-lab/evm-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da15cab58cbaaf01db60d8e67007017a770017bc33db5b17508dcd03db50b1a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Transaction Replay Attack

github.com/cosmos/ethermint is vulnerable to Transaction Replay Attack. The vulnerability is due to a flaw in the EVM module where, if the victim sends a very large nonce transaction, the attacker can replay the transaction through the application...

Consensus Attack

github.com/ethereum/go-ethereum is vulnerable to a Consensus Attack. The vulnerability is due to Geth's pre-compiled dataCopy contract performing a shallow copy on invocation, which allows an attacker to manipulate Ethereum Virtual Machine EVM memory and cause a consensus mismatch between nodes...

Malicious code in evm-oracle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e3c91e468e1cf1503476c51feda4ab0bfb701bc195a5b682801c9182256704b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8901 Malicious code in evm-oracle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e3c91e468e1cf1503476c51feda4ab0bfb701bc195a5b682801c9182256704b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-48803 phy: ti: Fix missing sentinel for clk_div_table

In the Linux kernel, the following vulnerability has been resolved: phy: ti: Fix missing sentinel for clkdivtable gettablemaxdiv tries to access "clkdivtable" array out of bound defined in phy-j721e-wiz.c. Add a sentinel entry to prevent the following global-out-of-bounds error reported by enabli...

MAL-2024-7095 Malicious code in bluefin-exchange-contracts-evm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5de25fa81235c71b8908ce290060da71c925d70200b0aa17c4ce09f9a4517e1e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bluefin-exchange-contracts-evm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5de25fa81235c71b8908ce290060da71c925d70200b0aa17c4ce09f9a4517e1e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-37159 Evmos is missing create validator check

Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. This vulnerability allowed a user to create a validator using vested tokens to deposit the self-bond. This vulnerability is fixed in 18.0.0...

CVE-2024-37153 Evmos's contract balance not updating correctly after interchain transaction

Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. There is an issue with how to liquid stake using Safe which itself is a contract. The bug only appears when there is a local state change together with an ICS20 transfer in the same function and uses the contract's balance, that...

CVE-2024-37153 Evmos's contract balance not updating correctly after interchain transaction

Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. There is an issue with how to liquid stake using Safe which itself is a contract. The bug only appears when there is a local state change together with an ICS20 transfer in the same function and uses the contract's balance, that...

MAL-2024-1399 Malicious code in stablecoin-evm (npm)

This package is considered malicious because it communicates with a domain associated with malicious activity and the package executes one or more commands associated with malicious behavior. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware...

CVE-2024-32644

Evmos is a scalable, high-throughput Proof-of-Stake EVM blockchain that is fully compatible and interoperable with Ethereum. Prior to 17.0.0, there is a way to mint arbitrary tokens due to the possibility to have two different states not in sync during the execution of a transaction. The exploit ...