CVE-2022-39354: Incorrect is_static parameter for custom stateful precompiles in SputnikVM (evm)
A custom stateful precompile can use the is_static
parameter to determine if the call is executed in a static context (via STATICCALL
), and thus decide if stateful operations should be done. Previously, the passed is_static
parameter was incorrect – it was only set to true
if the call comes from a direct STATICCALL
opcode. However, once a static call context is entered, it should stay static.
The issue only impacts custom precompiles that actually uses is_static
. The maintainers estimate the usage is low. However, for those affected, it can lead to possible incorrect state transitions.
References
Detect and mitigate CVE-2022-39354 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →