CVE-2025-53638CWE-754

Solady lacks extcodesize validation on implementation in ERC4337Factory

Medium · published July 17, 2025

CVSS v4.0
6.9
EPSS
0%
Percentile
28.5
In the wild
Unconfirmed
What it is

Solady is software that provides Solidity snippets with APIs. Starting in version 0.0.125 and prior to version 0.1.24, when an account is deployed via a proxy, using regular Solidity to call its initialization function may result in a silent failure, if the initialization function does not return a `bool` or some other return data. This is because regular Solidity uses `extcodesize(proxy)` to decide if call succeeds. This is insufficient in the case when the proxy points to an empty implementation. Users should upgrade to Solady v0.1.24 or later to receive a patch. Deploy any affected implementations and their factories on new EVM chains as soon as possible.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00360 · 28.5th percentile
Weakness
CWE-754 · Improper Check for Unusual or Exceptional Conditions
Published
2025-07-17T17:54Z
EPSS history
Timeline
  • 17 JUL 17:54Z
    Solady lacks extcodesize validation on implementation in ERC4337Factory
    cvelistv5