CVE-2022-39354: Incorrect is_static parameter for custom stateful precompiles in SputnikVM (evm)
A custom stateful precompile can use the is_static parameter to determine if the call is executed in a static context (via STATICCALL), and thus decide if stateful operations should be done. Previously, the passed is_static parameter was incorrect – it was only set to true if the call comes from a direct STATICCALL opcode. However, once a static call context is entered, it should stay static.
The issue only impacts custom precompiles that actually uses is_static. The maintainers estimate the usage is low. However, for those affected, it can lead to possible incorrect state transitions.
References
Code Behaviors & Features
Detect and mitigate CVE-2022-39354 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →