CVE-2023-34449
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
In versions 4.0.0 to 4.2.1 of the ink! library, there is a bug related to incorrect decoding of the return value when using delegate call mechanics. This issue affects both `CallBuilder::delegate` and `ink_env::invoke_contract_delegate`.
Risk Assessment
Organizations using ink! contracts in the 4.x series may encounter issues with the proper functioning of delegate calls, potentially leading to unpredictable contract behavior.
Recommendation
It is recommended to upgrade to version 4.2.1 to apply the patch and avoid issues related to return value decoding.
Original NVD description (English source)
ink! is an embedded domain specific language to write smart contracts in Rust for blockchains built on the Substrate framework. Starting in version 4.0.0 and prior to version 4.2.1, the return value when using delegate call mechanics, either through `CallBuilder::delegate` or `ink_env::invoke_contract_delegate`, is decoded incorrectly. This bug was related to the mechanics around decoding a call's return buffer, which was changed as part of pull request 1450. Since this feature was only released in ink! 4.0.0, no previous versions are affected. Users who have an ink! 4.x series contract should upgrade to 4.2.1 to receive a patch.