input-output-hk

4 results · Feed

• High 8.1
  CVE-2023-42449

  Malicious head initialiser can extract PTs from control of Hydra scripts, leading to locked participant commits or spoofed commits

  Hydra is the two-layer scalability solution for Cardano. Prior to version 0.13.0, it is possible for a malicious head initializer to extract one or more PTs for the head they are initializing due to incorrect data validation logic in the head token minting po…

  input-output-hk hydra
  Oct 4, 2023
• High 8.1
  CVE-2023-42448

  Hydra's contestation period in head datum can be modified during Close transaction, allowing malicious participant to freely modify the contestation deadline

  Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, the specification states that the contestation period in the datum of the UTxO at the head validator must stay unchanged as the state progresses from Open to Closed (Close trans…

  input-output-hk hydra
  Oct 4, 2023
• Critical 9.1
  CVE-2023-38701

  Hydra's committed UTxOs at Commit validator and UTxOs at Initial validator can be spent arbitrarily by anyone

  Hydra is the layer-two scalability solution for Cardano. Users of the Hydra head protocol send the UTxOs they wish to commit into the Hydra head first to the `commit` validator, where they remain until they are either collected into the `head` validator or th…

  input-output-hk hydra
  Oct 4, 2023
• Medium 6.5
  CVE-2023-42806

  Snapshot signature not including HeadID will allow replay attacks

  Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, not signing and verifying `$\mathsf{cid}$` allows an attacker (which must be a participant of this head) to use a snapshot from an old head instance with the same participants t…

  input-output-hk hydra
  Sep 21, 2023