CVE-2023-42448
📋 TL;DR
This vulnerability in Hydra (Cardano's layer-2 solution) allows malicious participants to manipulate the contestation deadline during head closure. Attackers could either prematurely fanout funds without allowing other participants to contest, or permanently lock funds in the head. This affects all Hydra users participating in heads with untrusted counterparties.
💻 Affected Systems
- Hydra (Cardano layer-2 solution)
📦 What is this software?
Hydra by Iohk
⚠️ Risk & Real-World Impact
Worst Case
Permanent loss of funds locked in Hydra heads, with attackers stealing assets or making them irrecoverable.
Likely Case
Malicious participants exploiting timing to gain unfair advantage in fund distribution during head closures.
If Mitigated
With proper monitoring and trusted participants, impact is limited to potential timing manipulation rather than fund loss.
🎯 Exploit Status
Exploitation requires being a participant in a Hydra head and understanding of Cardano smart contracts.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.13.0
Vendor Advisory: https://github.com/input-output-hk/hydra/security/advisories/GHSA-mgcx-6p7h-5996
Restart Required: Yes
Instructions:
1. Stop all Hydra nodes. 2. Update to Hydra version 0.13.0 or later. 3. Restart Hydra nodes. 4. Ensure all participants in heads are updated.
🔧 Temporary Workarounds
Temporarily disable head creation
allPrevent creation of new Hydra heads until patched
# Configure Hydra to reject new head creation requests
🧯 If You Can't Patch
- Only participate in Hydra heads with trusted counterparties
- Monitor head transactions closely for abnormal contestation period changes
🔍 How to Verify
Check if Vulnerable:
Check Hydra version: if <0.13.0, you are vulnerableCheck Version:
hydra-node --versionVerify Fix Applied:
Verify Hydra version is 0.13.0 or later and check that head validator includes contestation period validation📡 Detection & Monitoring
Log Indicators:
- Unexpected contestation period changes in head validator logs
- Abnormal head closure timing
Network Indicators:
- Unusual transaction patterns during head closure
- Suspicious timing of fanout transactions
SIEM Query:
hydra AND (contestation_period OR head_closure) AND abnormal🔗 References
- https://github.com/input-output-hk/hydra/blob/master/CHANGELOG.md#0130---2023-10-03
- https://github.com/input-output-hk/hydra/blob/master/hydra-plutus/src/Hydra/Contract/Head.hs#L284-L296
- https://github.com/input-output-hk/hydra/blob/master/hydra-plutus/src/Hydra/Contract/Head.hs#L320-L323
- https://github.com/input-output-hk/hydra/commit/2f45529729e28254a62f7a7c8d6649066923ed1f
- https://github.com/input-output-hk/hydra/security/advisories/GHSA-mgcx-6p7h-5996
- https://github.com/input-output-hk/hydra/blob/master/CHANGELOG.md#0130---2023-10-03
- https://github.com/input-output-hk/hydra/blob/master/hydra-plutus/src/Hydra/Contract/Head.hs#L284-L296
- https://github.com/input-output-hk/hydra/blob/master/hydra-plutus/src/Hydra/Contract/Head.hs#L320-L323
- https://github.com/input-output-hk/hydra/commit/2f45529729e28254a62f7a7c8d6649066923ed1f
- https://github.com/input-output-hk/hydra/security/advisories/GHSA-mgcx-6p7h-5996
