3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-rm83-pxjx-pr5j

GHSA-rm83-pxjx-pr5j: Duplicate Advisory: CosmWasm affected by arithmetic overflows

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-8724-5xmm-w5xq. This link is maintained to preserve external references.

Original Description

The cosmwasm-std crate before 2.0.2 for Rust allows integer overflows that cause incorrect contract calculations.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-rm83-pxjx-pr5j

GHSA-rm83-pxjx-pr5j:

3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
cosmwasm-std	rust	>= 1.3.0, < 1.4.4	1.4.4
cosmwasm-std	rust	>= 1.5.0, < 1.5.4	1.5.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the use of wrapping arithmetic in several mathematical functions within the cosmwasm-std crate. Specifically, the pow and neg functions for large integer types (Uint256, Uint512, Int256, Int512) were implemented to wrap on overflow instead of panicking. This behavior, while sometimes intentional in low-level programming, is dangerous in the context of smart contracts where precise and predictable calculations are paramount.

The patches for this vulnerability, identified by comparing the git tags for the patched versions, introduced new functions (panicking_pow, panicking_neg) that explicitly panic on overflow. The original functions were left unchanged to maintain backward compatibility, but their use is now implicitly discouraged in favor of the safer, panicking alternatives. The presence of these new functions in the patch serves as direct evidence that the original functions are the source of the vulnerability.

For a security engineer, this means that any contract using cosmwasm-std versions prior to 1.4.4 or 1.5.4 (in their respective release series) and utilizing the pow or neg functions on Uint/Int 256 or 512 is potentially vulnerable to logic errors caused by silent integer overflows. The remediation is to upgrade to a patched version and, ideally, to replace the use of the vulnerable functions with their panicking counterparts to ensure that any overflow condition is caught immediately.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.