CVE-2023-45130 — Frontier is Substrate's Ethereum compatibility layer

Frontier is Substrate's Ethereum compatibility layer. Prior to commit aea528198b3b226e0d20cce878551fd4c0e3d5d0, at the end of a contract execution, when opcode SUICIDE marks a contract to be deleted, the software uses `storage::remove_prefix` (now renamed to `storage::clear_

01What is this vulnerability?

Frontier is Substrate's Ethereum compatibility layer. Prior to commit aea528198b3b226e0d20cce878551fd4c0e3d5d0, at the end of a contract execution, when opcode SUICIDE marks a contract to be deleted, the software uses `storage::remove_prefix` (now renamed to `storage::clear_prefix`) to remove all storages associated with it. This is a single IO primitive call passing the WebAssembly boundary. For…

02Affected products

Vendor	Product	Versions
paritytech	frontier	<= 0.1.0

03Active exploitation status

Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.

04Recommended remediation

• Patch to a fixed version listed in the vendor advisory (see references below).
• Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
• Hunt historical logs for exploitation indicators — see Detection signatures below.

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.

07Related CVEs

No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.

08Timeline

• Published: 2023-10-13T12:14:15.105Z
• Last modified: 2024-09-17T14:30:56.468Z

09References

• github.com — https://github.com/paritytech/frontier/security/advisories/GHSA-gc88-2gvv-gp3v
• github.com — https://github.com/paritytech/frontier/pull/1212
• github.com — https://github.com/paritytech/frontier/commit/aea528198b3b226e0d20cce878551fd4c0…