GitHub Advisoryadvisory · crates.io

GHSA-8r76-fr72-j32w Creator Verification Error when Bubblegum Activate

HIGH Published 2022-12-12 Modified 2022-12-12 Official page ↗

Ecosystem: crates.io
Packages: mpl-bubblegum, mpl-token-metadata
Severity: High
Reviewed: 2022-12-12

Affected packages

• crates.io mpl-bubblegum: < 0.6.0 → fixed in 0.6.0 • crates.io mpl-token-metadata: >= 1.5.0, < 1.6.3 → fixed in 1.6.3

Description

This was an error found by @metamania01 of the Audit Company Solshield. It allowed one to verify a creator that did not sign by making use of a provision in Token Metadata that allows Creators who have signed compressed nfts to allow them to decompress with verified creators. The issue is now patched. For more info see. https://twitter.com/thehasheddude/status/1601642138143375360

References

https://github.com/metaplex-foundation/metaplex-program-library/security/advisories/GHSA-8r76-fr72-j32w web
https://github.com/metaplex-foundation/metaplex-program-library/commit/c18591a7ce9bb561940cb94df4b7c35ef9cc0f57 web
https://github.com/metaplex-foundation/metaplex-program-library package
https://twitter.com/thehasheddude/status/1601642138143375360 web