CVE-2021-43839CWE-670

Drainage of FeeCollector's Block Transaction Fees

High · published December 21, 2021

CVSS v3.1
7.5
EPSS
1%
Percentile
71.4
In the wild
Unconfirmed
What it is

Cronos is a commercial implementation of a blockchain. In Cronos nodes running versions before v0.6.5, it is possible to take transaction fees from Cosmos SDK's FeeCollector for the current block by sending a custom crafted MsgEthereumTx. This problem has been patched in Cronos v0.6.5. There are no tested workarounds. All validator node operators are recommended to upgrade to Cronos v0.6.5 at their earliest possible convenience.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01356 · 71.4th percentile
Weakness
CWE-670 · Always-Incorrect Control Flow Implementation
Published
2021-12-21T16:50Z
EPSS history
Timeline
  • 21 DEC 16:50Z
    Drainage of FeeCollector's Block Transaction Fees
    cvelistv5