Polkadot Frontier contains silent failure in Curve25519 arithmetic precompiles with malformed points
Priority MEDIUM 49CWE-327Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-327.
Summary
Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. In versions prior to commit 36f70d1, the Curve25519Add and Curve25519ScalarMul precompiles incorrectly handle invalid Ristretto point representations. Instead of returning an error, they silently treat invalid input bytes as the Ristretto identity element, leading to potentially incorrect cryptographic results. This is fixed in commit 36f70d1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00367 30th percentileScored 2026-11-07
Fix Fixed frontier (polkadot-evm): 36f70d1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| polkadot-evm | frontier | before 36f70d1 | 36f70d1 | Patch available | CNA |
- frontier Vendorpolkadot-evm Affected before 36f70d1 Fixed in 36f70d1 Patch available CNA
Remediation
- Fix · CNA frontier (polkadot-evm) Fixed in 36f70d1
Timeline
- 2026-10-02 Threatist record created from CVE-2025-54426
References
Other 4
- https://github.com/polkadot-evm/frontier/security/advisories/GHSA-v4q3-23rh-w5mw
- https://github.com/polkadot-evm/frontier/pull/1720/commits/8ed6053fb868495477ba2409f7e64f439df76f96
- https://github.com/polkadot-evm/frontier/commit/36f70d1defcaeaed5a453015f6c98c21bb5b121b
- https://dotpal.io/assets/files/frontier-srlabs-2505-718c3bfa5df9fed1862fed05de506859.pdf
More polkadot-evm vulnerabilities
- TI-2025-34232 Polkadot Frontier contains missing `check_inherent` for `note_min_gas_price_target` inflates gas price CVSS 4.0MEDIUM 6.9
- TI-2025-34234 Polkadot Frontier's constructing smart contract can bypass precompile address bounding CVSS 4.0MEDIUM 6.9
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences