GitHub Advisoryadvisory · crates.io

GHSA-8724-5xmm-w5xq CosmWasm affected by arithmetic overflows

LOW Published 2024-04-24 Modified 2025-07-28 Official page ↗
Aliases
CVE-2024-58263
Ecosystem
crates.io
Packages
cosmwasm-std
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-190
Reviewed
2024-04-24

Affected packages

• crates.io cosmwasm-std: >= 1.3.0, < 1.4.4 → fixed in 1.4.4 • crates.io cosmwasm-std: >= 1.5.0, < 1.5.4 → fixed in 1.5.4 • crates.io cosmwasm-std: >= 2.0.0, < 2.0.2 → fixed in 2.0.2

Description

Some mathematical operations in `cosmwasm-std` use wrapping math instead of panicking on overflow for very big numbers. This can lead to wrong calculations in contracts that use these operations. Affected functions: • `Uint{256,512}::pow` / `Int{256,512}::pow` • `Int{256,512}::neg` Affected if `overflow-checks = true` is not set: • `Uint{64,128}::pow` / `Int{64,128}::pow` • `Int{64,128}::neg`

Related

Alias · CVE (1)

  • CVE-2024-58263 The cosmwasm-std crate before 2.0.2 for Rust allows integer overflows that cause incorrect contract calculations. vulnerability

Weakness · CWE (1)

  • CWE-190 Integer Overflow or Wraparound weakness

References