CVE-2022-31111

Frontier is Substrate's Ethereum compatibility layer. In affected versions the truncation done when converting between EVM balance type and Substrate balance type was incorrectly implemented. This leads to possible discrepancy between appeared EVM transfer value and actual Substrate value transferred. It is recommended that an emergency upgrade to be planned and EVM execution temporarily paused in the mean time. The issue is patched in Frontier master branch commit fed5e0a9577c10bea021721e8c2c5c378e16bf66 and polkadot-v0.9.22 branch commit e3e427fa2e5d1200a784679f8015d4774cedc934. This vulnerability affects only EVM internal states, but not Substrate balance states or node. You can temporarily pause EVM execution (by setting up a Substrate `CallFilter` that disables `pallet-evm` and `pallet-ethereum` calls before the patch can be applied.

• CWE-670

• https://github.com/paritytech/frontier/commit/e3e427fa2e5d1200a784679f8015d4774cedc934Patch, Third Party Advisory
• https://github.com/paritytech/frontier/commit/fed5e0a9577c10bea021721e8c2c5c378e16bf66Patch, Third Party Advisory
• https://github.com/paritytech/frontier/pull/753Issue Tracking, Patch, Third Party Advisory
• https://github.com/paritytech/frontier/security/advisories/GHSA-hc8w-mx86-9fcjPatch, Third Party Advisory
• https://github.com/paritytech/frontier/commit/e3e427fa2e5d1200a784679f8015d4774cedc934Patch, Third Party Advisory
• https://github.com/paritytech/frontier/commit/fed5e0a9577c10bea021721e8c2c5c378e16bf66Patch, Third Party Advisory
• https://github.com/paritytech/frontier/pull/753Issue Tracking, Patch, Third Party Advisory
• https://github.com/paritytech/frontier/security/advisories/GHSA-hc8w-mx86-9fcjPatch, Third Party Advisory

Published

Jul 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31106Underscore.deep is a collection of Underscore mixins that op…9.8
• CVE-2022-31107Grafana is an open-source platform for monitoring and observ…7.5
• CVE-2022-31108Mermaid is a JavaScript based diagramming and charting tool …6.1
• CVE-2022-31109laminas-diactoros is a PHP package containing implementation…6.1
• CVE-2022-3111An issue was discovered in the Linux kernel through 5.16-rc6…5.5
• CVE-2022-31110RSSHub is an open source, extensible RSS feed generator. In …7.5
• CVE-2022-31112Parse Server is an open source backend that can be deployed …8.2
• CVE-2022-31113Canarytokens is an open source tool which helps track activi…6.1
• CVE-2022-31114backpack/crud provides Create, Read, Update & Delete (CRUD) …5.1
• CVE-2022-31115opensearch-ruby is a community-driven, open source fork of e…8.8
• CVE-2022-31116UltraJSON is a fast JSON encoder and decoder written in pure…7.5
• CVE-2022-31117UltraJSON is a fast JSON encoder and decoder written in pure…5.9