Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-40583

UltraDAG: SmartOp Vote Path Triggers Fatal Supply Invariant Halt

Description

UltraDAG is a minimal DAG-BFT blockchain in Rust. In version 0.1, a non-council attacker can submit a signed SmartOp::Vote transaction that passes signature, nonce, and balance prechecks, but fails authorization only after state mutation has already occurred.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

UltraDAGcom core

  • = 0.1affected

References