hydra-node dangerously assumes L1 event finality and does not consider failed transactions
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Hydra is a layer-two scalability solution for Cardano. Prior to version 0.22.0, the process assumes L1 event finality and does not consider failed transactions. Currently, Cardano L1 is monitored for certain events which are necessary for state progression. At the moment, Hydra considers those events as finalized as soon as they are recognized by the node participants making such transactions the target of re-org attacks. The system does not currently consider the fact that failed transactions on the Cardano L1 can indeed appear in blocks because these transactions are so infrequent. This issue has been patched in version 0.22.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| cardano-scaling | hydra | before 0.22.0 | 0.22.0 | Patch available | CNA |
- hydra Vendorcardano-scaling Affected before 0.22.0 Fixed in 0.22.0 Patch available CNA
Remediation
- Fix · CNA hydra (cardano-scaling) Fixed in 0.22.0
Timeline
- 2026-10-02 Threatist record created from CVE-2025-48886
References
More cardano-scaling vulnerabilities
- TI-2026-83294 Missing authorization in Hydra Deposit Claim enables fund redirection CVSS 4.0HIGH 8.2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences