CVE-2026-24783
📋 TL;DR
This vulnerability in the soroban-fixed-point-math library causes incorrect rounding in division operations when both the intermediate product and divisor are negative. It affects Soroban smart contracts using signed fixed-point math operations, potentially leading to incorrect financial calculations or contract logic failures. All users of versions 1.3.0 and 1.4.0 are affected.
💻 Affected Systems
- soroban-fixed-point-math library
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Smart contracts could produce mathematically incorrect results leading to financial losses, incorrect token transfers, or contract logic failures that could be exploited for financial gain.
Likely Case
Incorrect rounding in financial calculations causing minor discrepancies in contract outputs, potentially affecting token balances or exchange rates.
If Mitigated
With proper input validation and testing, the impact is limited to edge cases where both intermediate product and divisor are negative.
🎯 Exploit Status
Exploitation requires triggering the vulnerable mulDiv function with specific negative inputs. No known public exploits exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.1 and 1.4.1
Vendor Advisory: https://github.com/script3/soroban-fixed-point-math/security/advisories/GHSA-x5m4-43jf-hh65
Restart Required: No
Instructions:
1. Update soroban-fixed-point-math dependency to version 1.3.1 or 1.4.1. 2. Rebuild and redeploy affected smart contracts. 3. Test contract functionality with edge cases involving negative values.
🧯 If You Can't Patch
- Implement input validation to avoid negative divisor values in division operations.
- Use alternative math libraries or custom implementations for critical calculations.
🔍 How to Verify
Check if Vulnerable:
Check package.json or Cargo.toml for soroban-fixed-point-math version 1.3.0 or 1.4.0.Check Version:
grep 'soroban-fixed-point-math' package.json || grep 'soroban-fixed-point-math' Cargo.tomlVerify Fix Applied:
Verify the library version is updated to 1.3.1 or 1.4.1 and test division operations with negative inputs.📡 Detection & Monitoring
Log Indicators:
- Unexpected contract behavior with negative value calculations
- Division operation errors in smart contract logs
Network Indicators:
- Unusual transaction patterns involving negative value calculations
SIEM Query:
Not applicable for smart contract vulnerabilities🔗 References
- https://github.com/script3/soroban-fixed-point-math/commit/c9233f7094198a49ed66a4d75786a8a3755c936a
- https://github.com/script3/soroban-fixed-point-math/releases/tag/v1.3.1
- https://github.com/script3/soroban-fixed-point-math/releases/tag/v1.4.1
- https://github.com/script3/soroban-fixed-point-math/security/advisories/GHSA-x5m4-43jf-hh65
