Read the docs
TI-2023-17275 Aliases CVE-2023-34449GHSA-853p-5678-hv8f

ink! vulnerable to incorrect decoding of storage value when using `DelegateCall`

Priority MEDIUM 63CWE-253Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

ink! is an embedded domain specific language to write smart contracts in Rust for blockchains built on the Substrate framework. Starting in version 4.0.0 and prior to version 4.2.1, the return value when using delegate call mechanics, either through `CallBuilder::delegate` or `ink_env::invoke_contract_delegate`, is decoded incorrectly. This bug was related to the mechanics around decoding a call's return buffer, which was changed as part of pull request 1450. Since this feature was only released in ink! 4.0.0, no previous versions are affected. Users who have an ink! 4.x series contract should upgrade to 4.2.1 to receive a patch.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00967 62nd percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Fixed ink (paritytech): 4.2.1ink (crates.io): 4.2.1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
paritytechink4.0.0 to before 4.2.14.2.1Patch availableCNA
—ink (crates.io)4.0.0 to before 4.2.14.2.1Patch availableGHSA-853p-5678-hv8f
—ink_env (crates.io)4.0.0 to before 4.2.14.2.1Patch availableGHSA-853p-5678-hv8f
  • ink Vendorparitytech Affected 4.0.0 to before 4.2.1 Fixed in 4.2.1 Patch available CNA
  • ink (crates.io) Vendor— Affected 4.0.0 to before 4.2.1 Fixed in 4.2.1 Patch available GHSA-853p-5678-hv8f
  • ink_env (crates.io) Vendor— Affected 4.0.0 to before 4.2.1 Fixed in 4.2.1 Patch available GHSA-853p-5678-hv8f

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:parity:ink\!:*:*:*:*:*:rust:*:*4.0.0 to before 4.2.1Vulnerableparitytech
  • cpe:2.3:a:parity:ink\!:*:*:*:*:*:rust:*:* Versions 4.0.0 to before 4.2.1 Vulnerable ·paritytech

Remediation

  • Fix · CNA ink (paritytech) Fixed in 4.2.1
  • Fix · GHSA-853p-5678-hv8f ink (crates.io) Fixed in 4.2.1 Advisory →
  • Fix · GHSA-853p-5678-hv8f ink_env (crates.io) Fixed in 4.2.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-34449
  2. 2026-10-03 Alias added: GHSA-853p-5678-hv8f

References

Exploit 3

Patch 2

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences