GHSA-pm4j-7r4q-ccg8: Soroban: Muxed address<->ScVal conversions may break after a conversion failure
Soroban host ensures that MuxedAddress objects can’t be used as storage keys in order to proactively prevent the contract logic bugs. However, due to a bug in Soroban host implementation, a failure in Val->ScVal conversion during the storage key computation will have the flag indicating that storage conversion is happening stuck in the true state until the next storage access. While the flag is stuck in true state, any MuxedAddress object conversions to ScVal will fail, i.e. a failure will occur if a MuxedAddress is emitted in the event or is serialized to XDR via a host function.
References
Code Behaviors & Features
Detect and mitigate GHSA-pm4j-7r4q-ccg8 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →