GHSA-8f9f-pc5v-9r5h
Malicious takeover of previously owned ENS names
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @ensdomains/ens | < 0.4.0 | 0.4.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
A user who owns an ENS domain can set a "trapdoor", allowing them to transfer ownership to another user, and later regain ownership without the new owner's consent or awareness.
### Patches
A new ENS deployment is being rolled out that fixes this vulnerability in the ENS registry. The registry is newly deployed at [0x00000000000C2E074eC69A0dFb2997BA6C7d2e1e](https://etherscan.io/address/0x00000000000C2E074eC69A0dFb2997BA6C7d2e1e).
### Workarounds
Do not accept transfers of ENS domains from other users on the old registrar.
References
External links from the advisory. They lead to third-party sites.