by Kastro
Paper/Archive/CVE-2025-54426

CVE-2025-54426

polkadot-evm frontier — Polkadot Frontier contains silent failure in Curve25519 arithmetic precompiles with malformed points

EPSS 0.4%CVSS 9.9
critical.is priorityof 100
36
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 30.5.305 × 206.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. In versions prior to commit 36f70d1, the Curve25519Add and Curve25519ScalarMul precompiles incorrectly handle invalid Ristretto point representations. Instead of returning an error, they silently treat invalid input bytes as the Ristretto identity element, leading to potentially incorrect cryptographic results. This is fixed in commit 36f70d1.

Affected

ProductAffectedFixed inSource
frontier< 36f70d1–CNA

Scores by source

GitHub_M (CNA)9.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:H/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/polkadot-evm/frontier/security/advisories/GHSA-v4q3-23rh-w5mwrefgithub.com/polkadot-evm/frontier/pull/1720/commits/8ed6053fb868495477ba2409f7e64f439df76f96refgithub.com/polkadot-evm/frontier/commit/36f70d1defcaeaed5a453015f6c98c21bb5b121brefdotpal.io/assets/files/frontier-srlabs-2505-718c3bfa5df9fed1862fed05de506859.pdf