~ / search / GHSA-8724-5xmm-w5xq

GHSA-8724-5xmm-w5xq

CosmWasm affected by arithmetic overflows

Source: GitHub Advisory Database (reviewed) Low CVE-2024-58263

Packages

EcosystemPackageAffectedFixed in
crates.io cosmwasm-std >= 1.3.0, < 1.4.4 1.4.4
crates.io cosmwasm-std >= 1.5.0, < 1.5.4 1.5.4
crates.io cosmwasm-std >= 2.0.0, < 2.0.2 2.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

Some mathematical operations in `cosmwasm-std` use wrapping math instead of panicking on overflow for very big numbers. This can lead to wrong calculations in contracts that use these operations. Affected functions: - `Uint{256,512}::pow` / `Int{256,512}::pow` - `Int{256,512}::neg` Affected if `overflow-checks = true` is not set: - `Uint{64,128}::pow` / `Int{64,128}::pow` - `Int{64,128}::neg`

References

External links from the advisory. They lead to third-party sites.