CVE-2023-34449

ink! is an embedded domain specific language to write smart contracts in Rust for blockchains built on the Substrate framework. Starting in version 4.0.0 and prior to version 4.2.1, the return value when using delegate call mechanics, either through `CallBuilder::delegate` or `ink_env::invoke_contract_delegate`, is decoded incorrectly. This bug was related to the mechanics around decoding a call's return buffer, which was changed as part of pull request 1450. Since this feature was only released in ink! 4.0.0, no previous versions are affected. Users who have an ink! 4.x series contract should upgrade to 4.2.1 to receive a patch.

• CWE-253
• CWE-754

• https://docs.rs/ink_env/4.2.0/ink_env/call/struct.CallBuilder.html#method.delegateExploit, Third Party Advisory
• https://docs.rs/ink_env/4.2.0/ink_env/fn.invoke_contract_delegate.htmlExploit, Third Party Advisory
• https://github.com/paritytech/ink/commit/f1407ee9f87e5f64d467a22d26ee88f61db7f3dbPatch
• https://github.com/paritytech/ink/pull/1450Patch, Vendor Advisory
• https://github.com/paritytech/ink/security/advisories/GHSA-853p-5678-hv8fExploit, Patch, Vendor Advisory
• https://docs.rs/ink_env/4.2.0/ink_env/call/struct.CallBuilder.html#method.delegateExploit, Third Party Advisory
• https://docs.rs/ink_env/4.2.0/ink_env/fn.invoke_contract_delegate.htmlExploit, Third Party Advisory
• https://github.com/paritytech/ink/commit/f1407ee9f87e5f64d467a22d26ee88f61db7f3dbPatch
• https://github.com/paritytech/ink/pull/1450Patch, Vendor Advisory
• https://github.com/paritytech/ink/security/advisories/GHSA-853p-5678-hv8fExploit, Patch, Vendor Advisory

Published

Jun 14, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-34443Combodo iTop is a simple, web based IT Service Management to…6.1
• CVE-2023-34444Combodo iTop is a simple, web based IT Service Management to…6.1
• CVE-2023-34445Combodo iTop is a simple, web based IT Service Management to…6.1
• CVE-2023-34446iTop is an open source, web-based IT service management plat…6.1
• CVE-2023-34447iTop is an open source, web-based IT service management plat…6.1
• CVE-2023-34448Grav is a flat-file content management system. Prior to vers…7.2
• CVE-2023-3445Cross-site Scripting (XSS) - Stored in GitHub repository spi…4.8
• CVE-2023-34450CometBFT is a Byzantine Fault Tolerant (BFT) middleware that…5.3
• CVE-2023-34451CometBFT is a Byzantine Fault Tolerant (BFT) middleware that…8.2
• CVE-2023-34452Grav is a flat-file content management system. In versions 1…6.1
• CVE-2023-34453snappy-java is a fast compressor/decompressor for Java. Due …7.5
• CVE-2023-34454snappy-java is a fast compressor/decompressor for Java. Due …7.5