Medium severity · published Jul 6, 2022
CVE-2022-31111
Frontier is Substrate's Ethereum compatibility layer
5.3
CVSS
1.4%
EPSS
No
On KEV
Description
Frontier is Substrate's Ethereum compatibility layer. In affected versions the truncation done when converting between EVM balance type and Substrate balance type was incorrectly implemented. This leads to possible discrepancy between appeared EVM transfer value and actual Substrate value transferred. It is recommended that an emergency upgrade to be planned and EVM execution temporarily paused in the mean time. The issue is patched in Frontier master branch commit fed5e0a9577c10bea021721e8c2c5c378e16bf66 and polkadot-v0.9.22 branch commit e3e427fa2e5d1200a784679f8015d4774cedc934. This vulnerability affects only EVM internal states, but not Substrate balance states or node. You can temporarily pause EVM execution (by setting up a Substrate `CallFilter` that disables `pallet-evm` and `pallet-ethereum` calls before the patch can be applied.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
Frontier · Parity
All versions, or not specified · source: NVD
Affected product
FR
Frontier
Parity
More from Frontier
7.5
CVE-2023-45130
Frontier is Substrate's Ethereum compatibility layer
7.5
CVE-2023-28431
Frontier is an Ethereum compatibility layer for Substrate
6.5
CVE-2022-36008
Frontier is Substrate's Ethereum compatibility layer
6.5
CVE-2022-21685
Frontier is Substrate's Ethereum compatibility layer
5.3
CVE-2022-39242
Frontier is an Ethereum compatibility layer for Substrate