Skip to content

Processing: MultiESDTNFTTransfer call on a SC address with missing function name

Critical
iulianpascalau published GHSA-qf7j-25g9-r63f Aug 29, 2022

Package

gomod elrond-go (Go)

Affected versions

<v1.3.33

Patched versions

v1.3.34

Description

Impact

Anyone who uses elrond-go to process blocks (historical or actual) that contains a transaction like this: MultiESDTNFTTransfer@01@54444558544b4b5955532d323631626138@00@0793afc18c8da2ca@ (mind the missing function name after the last @)
Basic functionality like p2p messaging, storage, API requests and such are unaffected.

Patches

Patch v1.3.34 or higher

Workarounds

No workarounds

References

For future reference, one can observe the following integration test:
[provide the link to the integration test]

For more information

If you have any questions or comments about this advisory:

Severity

Critical

CVE ID

CVE-2022-36058

Weaknesses

No CWEs