Skip to content

ckb type_id script resume may randomly fail

High severity GitHub Reviewed Published Nov 2, 2022 in nervosnetwork/ckb • Updated Jan 8, 2023

Package

cargo ckb (Rust)

Affected versions

>= 0.100.0, < 0.102.0

Patched versions

0.102.0

Description

Impact

https://github.com/nervosnetwork/ckb/blob/v0.101.2/script/src/verify.rs#L871-L879
TypeIdSystemScript resume handle is not correct when max_cycles is not enough, ScriptError::ExceededMaximumCycles will be raised directly ranther than suspend as expect, and also because script_group execution order is random, so this will happen randomly.

References

@doitian doitian published to nervosnetwork/ckb Nov 2, 2022
Published to the GitHub Advisory Database Nov 2, 2022
Reviewed Nov 2, 2022
Last updated Jan 8, 2023

Severity

High

Weaknesses

No CWEs

CVE ID

No known CVE

GHSA ID

GHSA-mcmr-49x3-4jqm

Source code

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.