Skip to content
OpenAdvisories

Package · crates.io

kora-lib

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium —
    GHSA-725g-w329-g7qr

    kora-lib: Token-2022 Transfer Fee Not Deducted During Payment Verification

    ## Summary When a user pays transaction fees using a Token-2022 token with a `TransferFeeConfig` extension, Kora's `verify_token_payment()` credits the full raw transfer `amount` as the payment value. However, the on-chain SPL Token-2022 program withholds a p…

    kora-lib crates.io
  • Medium —
    GHSA-x442-m7cc-hr92

    kora-lib: Unrecognized Instruction Types Create Empty Stubs That Bypass Fee Payer Policy

    ## Summary When inner CPI instructions use instruction types not recognized by Kora's parser (including Token-2022 extension instructions like `ConfidentialTransfer`, `TransferFeeExtension::WithdrawWithheldTokens`, etc.), they are reconstructed as stub instru…

    kora-lib crates.io