Description
Hyperbridge is a hyper-scalable coprocessor for verifiable, cross-chain interoperability. A critical vulnerability was discovered in the ismp-grandpa crate, that allowed a malicious prover easily convince the verifier of the finality of arbitrary headers. This could be used to steal funds or compromise other kinds of cross-chain applications. This vulnerability is fixed in 15.0.1.
References (3)
Scores
CVSS v4
9.3
EPSS
0.0008
EPSS Percentile
23.0%
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-347
CWE-670
Status
published
Products (4)
crates.io/grandpa-verifier
0 - 0.1.2crates.io
crates.io/grandpa-verifier-primitives
0 - 0.1.2crates.io
crates.io/ismp-grandpa
0 - 15.0.1crates.io
polytope-labs/hyperbridge
< 15.0.1
Published
Jan 28, 2025
Tracked Since
Feb 18, 2026