NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🦀 crates.io
Not in CISA KEV

Uncaught Panic in ORML Rewards PalletGHSA-5v93-9mqw-p9mh

Fix: open-web3-stack/open-runtime-module-library#1016

GHSA-5v93-9mqw-p9mh is a remote code execution vulnerability in orml-rewards. A fix is available for orml-rewards — see the affected versions and patch details below.

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Feb 14, 2025 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🦀orml-rewards

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.

Description

Summary

A vulnerability in the add_share function of the Rewards pallet (part of the ORML repository) can lead to an uncaught Rust panic when handling user-provided input exceeding the u128 range.

Affected Components

  • ORML Rewards pallet (rewards/src/lib.rs)
  • Any Substrate-based chain using ORML Rewards with add_share accepting unvalidated large u128 inputs

Technical Details

  • add_share performs arithmetic on user-supplied values (add_amount) of type T::Share (mapped to u128 in Acala).
  • If add_amount is large enough (e.g., i128::MAX), the intermediate result may overflow and panic on the cast to u128.
  • Validation occurs only after arithmetic, enabling a crafted input to trigger an overflow.

Impact

A malicious user submitting a specially crafted extrinsic can cause a panic in the runtime:

  • Denial of Service by crashing the node process.
  • Potential for invalid blocks produced by validators.

Likelihood

This issue is exploitable in production if there exists at least one rewards pool where reward tokens exceed twice the collateral tokens, allowing sufficiently large multiplication to exceed u128 bounds.

Remediation

Backport

The patch have been backported to following release branches:

  • polkadot-stable2407
  • polkadot-stable2409

A 1.0.1 patch release is made with this fix.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🦀crates.ioorml-rewardsall versions1.2.1cargo update -p orml-rewards --precise 1.2.1

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for orml-rewards, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update orml-rewards to 1.2.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-5v93-9mqw-p9mh is resolved across your whole dependency graph.

  3. Workarounds

    Constrain what reaches the vulnerable code: limit the size and shape of untrusted input, isolate the affected component in a sandboxed or least-privileged process, and enable the platform's memory-safety mitigations (ASLR, stack protector, hardened allocator) so an out-of-bounds access is more likely to fail closed than to be exploitable.

Frequently Asked Questions

## Summary A vulnerability in the `add_share` function of the **Rewards** pallet (part of the ORML repository) can lead to an uncaught Rust panic when handling user-provided input exceeding the `u128` range. ## Affected Components - **ORML Rewards** pallet (`rewards/src/lib.rs`) - Any Substrate-based chain using ORML Rewards with `add_share` accepting unvalidated large `u128` inputs ## Technical Details - `add_share` performs arithmetic on user-supplied values (`add_amount`) of type `T::Share` (mapped to `u128` in Acala). - If `add_amount` is large enough (e.g., `i128::MAX`), the intermediat
O3 Security · Impact-Aware SCA

Is GHSA-5v93-9mqw-p9mh in your dependencies?

Find it across crates.io, including transitive dependencies.

Scan my dependencies How O3 SCA works
Uncaught Panic in ORML Rewards Pallet