CVE-2023-38701

CVE-2023-38701 (Hydra) affects Hydra’s head protocol on Cardano. Before v0.12.0, the commit validator and the initial validator contain a flawed check when the ViaAbort redeemer is used, allowing any user to arbitrarily spend UTxOs at the validator. This enables an attacker to steal funds users c...

CVE-2023-42448

CVE-2023-42448 describes a vulnerability in Hydra (Cardano) prior to version 0.13.0 where the contestation period in the head UTxO datum could be modified during the Close transaction because the checkClose path does not enforce the required deadline. This could let a malicious participant fanout...

CVE-2023-42449

Hydra (Cardano) prior to v0.13.0 has an input validation flaw in the head initialiser that lets a malicious head initialiser extract PTs for the head being initialised, bypassing checks in HeadTokens.hs and off‑chain code. This can enable the attacker to lock other participants’ committed funds (...

CVE-2023-42806

Hydra (Cardano) prior to v0.13.0 has a vulnerability where not signing/verifying the cid allows a participant to reuse a snapshot from an old head to close the head or contest state with the same participants. This can cause incorrect value distribution (value extraction) or prevent finalization ...