Frontier's modexp precompile is slow for even modulus
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Frontier is an Ethereum compatibility layer for Substrate. Frontier's `modexp` precompile uses `num-bigint` crate under the hood. In the implementation prior to pull request 1017, the cases for modulus being even and modulus being odd are treated separately. Odd modulus uses the fast Montgomery multiplication, and even modulus uses the slow plain power algorithm. This gas cost discrepancy was not accounted for in the `modexp` precompile, leading to possible denial of service attacks. No fixes for `num-bigint` are currently available, and thus this issue is fixed in the short term by raising the gas costs for even modulus, and in the long term fixing it in `num-bigint` or switching to another modexp implementation. The short-term fix for Frontier is deployed at pull request 1017. There are no known workarounds aside from applying the fix.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| paritytech | frontier | up to 0.1.0 | — | No fix listed | CNA |
| — | pallet-evm-precompile-modexp (crates.io) | up to 1.0.0 | — | No fix listed | GHSA-fcmm-54jp-7vf6 |
- frontier Vendorparitytech Affected up to 0.1.0 Fixed in — No fix listed CNA
- pallet-evm-precompile-modexp (crates.io) Vendor— Affected up to 1.0.0 Fixed in — No fix listed GHSA-fcmm-54jp-7vf6
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:parity:frontier:*:*:*:*:*:*:*:* | before 2023-03-15 | Vulnerable | paritytech |
- cpe:2.3:a:parity:frontier:*:*:*:*:*:*:*:* Versions before 2023-03-15 Vulnerable ·paritytech
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-28431
- 2026-10-03 Alias added: GHSA-fcmm-54jp-7vf6
References
Patch 2
Advisory 2
More paritytech Frontier vulnerabilities
- TI-2023-24151 Frontier opcode SUICIDE touches too many storage values on large contracts CVSS 3.1HIGH 7.5
- TI-2022-16433 Message length overflow in frontier CVSS 3.1HIGH 7.1
- TI-2022-13155 Discrepency in transfer value and actual value due to incorrect truncation in Frontier CVSS 3.1MEDIUM 5.3
- TI-2022-06061 Integer underflow in Frontier CVSS 3.1MEDIUM 6.5
- TI-2022-18619 Incorrect Calculation in Frontier leads to inflated Ethereum chain gas prices CVSS 3.1MEDIUM 5.3
- TI-2021-17977 Validity check for signed Frontier-specific extrinsic not called in block execution CVSS 3.1MEDIUM 5.3
Sources
- CVE-2023-28431 · CVE Program
- CVE-2023-28431 · NVD
- FIRST EPSS
- GHSA-fcmm-54jp-7vf6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences