CVE-2023-35163 : Security Advisory and Response

Vega's validators able to submit duplicate transactions.

Understanding CVE-2023-35163

A vulnerability in Vega's decentralized trading platform that allows malicious validators to exploit the Vega network.

What is CVE-2023-35163?

Prior to version 0.71.6, a flaw in Vega allows malicious validators to trick the network into re-processing past Ethereum events, resulting in unauthorized gains.

The Impact of CVE-2023-35163

Malicious validators can manipulate the network to credit accounts with unauthorized funds, potentially leading to financial losses and exploitation of the system.

Technical Details of CVE-2023-35163

Details of the vulnerability, affected systems, and exploitation methods.

Vulnerability Description

The vulnerability allows a malicious validator to exploit Vega's Ethereum bridge, replaying transactions to gain unauthorized funds.

Affected Systems and Versions

The vulnerability affects Vega protocol versions less than 0.71.6.

Exploitation Mechanism

Malicious validators with network access can replay past Ethereum events to gain unauthorized funds, affecting Vega's trading platform.

Mitigation and Prevention

Steps to mitigate the vulnerability and prevent exploitation.

Immediate Steps to Take

Upgrade to version 0.71.6 to patch the vulnerability. Implement monitoring alerts to detect any unauthorized activities on the network.

Long-Term Security Practices

Ensure validators have secure access controls and monitor network activity regularly to prevent unauthorized transactions and exploits.

Patching and Updates

Regularly update Vega protocol to the latest version to ensure known vulnerabilities are patched and security measures are up to date.