ink

Version	Released
`6.0.0-beta.1` unknown	Nov 13, 2025
`6.0.0-beta` unknown	Oct 29, 2025
`6.0.0-alpha` unknown	May 02, 2025
`5.1.1` unknown	Dec 04, 2024
`5.1.0` unknown	Nov 28, 2024
`5.0.0` unknown	Mar 11, 2024
`5.0.0-rc.3` unknown	Mar 08, 2024
`5.0.0-rc.2` unknown	Feb 28, 2024
`5.0.0-rc.1` unknown	Feb 09, 2024
`5.0.0-rc` unknown	Nov 30, 2023
`5.0.0-alpha` unknown	Sep 09, 2023
`4.3.0` unknown	Aug 24, 2023
`4.2.1` unknown	Jun 14, 2023
`4.2.0` unknown 1 CVE	Apr 20, 2023
`4.1.0` unknown 1 CVE	Mar 23, 2023
`4.0.1` unknown 1 CVE	Feb 27, 2023
`4.0.0` unknown 1 CVE	Feb 15, 2023
`4.0.0-rc` unknown	Feb 01, 2023
`4.0.0-beta.1` unknown	Jan 25, 2023
`4.0.0-beta` unknown	Nov 22, 2022
`4.0.0-alpha.3` unknown	Sep 21, 2022
`0.0.0` unknown	Oct 20, 2017

6.0.0-beta.1 unknown

Nov 13, 2025

6.0.0-beta unknown

Oct 29, 2025

6.0.0-alpha unknown

May 02, 2025

5.1.1 unknown

Dec 04, 2024

5.1.0 unknown

Nov 28, 2024

5.0.0 unknown

Mar 11, 2024

5.0.0-rc.3 unknown

Mar 08, 2024

5.0.0-rc.2 unknown

Feb 28, 2024

5.0.0-rc.1 unknown

Feb 09, 2024

5.0.0-rc unknown

Nov 30, 2023

5.0.0-alpha unknown

Sep 09, 2023

4.3.0 unknown

Aug 24, 2023

4.2.1 unknown

Jun 14, 2023

4.2.0 unknown

1 CVE

CVE-2023-34449 GHSA-853p-5678-hv8f Jun 14, 2023

ink! vulnerable to incorrect decoding of storage value when using `DelegateCall`

5.3 / 10

Medium

Network Low None None Unchanged None Low None

Summary

The return value when using delegate call mechanics, either through CallBuilder::delegate or ink_env::invoke_contract_delegate, is being decoded incorrectly.

Description

Consider this minimal example:

// First contract, this will be performing a delegate call to the `Callee`.
#[ink(storage)]
pub struct Caller {
    value: u128,
}

#[ink(message)]
pub fn get_value(&self, callee_code_hash: Hash) -> u128 {
    let result = build_call::<DefaultEnvironment>()
        .delegate(callee_code_hash)
        .exec_input(ExecutionInput::new(Selector::new(ink::selector_bytes!(
            "get_value"
        ))))
        .returns::<u128>()
        .invoke();

    result
}

// Different contract, using this code hash for the delegate call.
#[ink(storage)]
pub struct Callee {
    value: u128,
}

#[ink(message)]
pub fn get_value(&self) -> u128 {
    self.value
}

In this example we are executing the Callee code in the context of the Caller contract. This means we'll be using the storage values of the Caller contract.

Running this code we expect the delegate call to return value as it was stored in the Caller contract. However, due to the reported bug a different value is returned (for the case of uints it is 256 times the expected value).

Impact

After conducting an analysis of the on-chain deployments of ink! contracts on Astar, Shiden, Aleph Zero, Amplitude and Pendulum, we have found that no contracts on those chains have been affected by the issue.

This bug was related to the mechanics around decoding a call's return buffer, which was changed as part of https://github.com/paritytech/ink/pull/1450. Since this feature was only released in ink! 4.0.0 no previous versions are affected.

Mitigations

If you have an ink! 4.x series contract, please update it to the 4.2.1 patch release that we just published.

Credits

Thank you Facundo Lerena from CoinFabrik for reporting this problem in a well-structured and responsible way.

Fixed in


          4.2.1

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 20, 2023

4.1.0 unknown

1 CVE

CVE-2023-34449 GHSA-853p-5678-hv8f Jun 14, 2023

ink! vulnerable to incorrect decoding of storage value when using `DelegateCall`

5.3 / 10

Medium

Network Low None None Unchanged None Low None

Summary

The return value when using delegate call mechanics, either through CallBuilder::delegate or ink_env::invoke_contract_delegate, is being decoded incorrectly.

Description

Consider this minimal example:

// First contract, this will be performing a delegate call to the `Callee`.
#[ink(storage)]
pub struct Caller {
    value: u128,
}

#[ink(message)]
pub fn get_value(&self, callee_code_hash: Hash) -> u128 {
    let result = build_call::<DefaultEnvironment>()
        .delegate(callee_code_hash)
        .exec_input(ExecutionInput::new(Selector::new(ink::selector_bytes!(
            "get_value"
        ))))
        .returns::<u128>()
        .invoke();

    result
}

// Different contract, using this code hash for the delegate call.
#[ink(storage)]
pub struct Callee {
    value: u128,
}

#[ink(message)]
pub fn get_value(&self) -> u128 {
    self.value
}

In this example we are executing the Callee code in the context of the Caller contract. This means we'll be using the storage values of the Caller contract.

Running this code we expect the delegate call to return value as it was stored in the Caller contract. However, due to the reported bug a different value is returned (for the case of uints it is 256 times the expected value).

Impact

After conducting an analysis of the on-chain deployments of ink! contracts on Astar, Shiden, Aleph Zero, Amplitude and Pendulum, we have found that no contracts on those chains have been affected by the issue.

This bug was related to the mechanics around decoding a call's return buffer, which was changed as part of https://github.com/paritytech/ink/pull/1450. Since this feature was only released in ink! 4.0.0 no previous versions are affected.

Mitigations

If you have an ink! 4.x series contract, please update it to the 4.2.1 patch release that we just published.

Credits

Thank you Facundo Lerena from CoinFabrik for reporting this problem in a well-structured and responsible way.

Fixed in


          4.2.1

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 23, 2023

4.0.1 unknown

1 CVE

CVE-2023-34449 GHSA-853p-5678-hv8f Jun 14, 2023

ink! vulnerable to incorrect decoding of storage value when using `DelegateCall`

5.3 / 10

Medium

Network Low None None Unchanged None Low None

Summary

The return value when using delegate call mechanics, either through CallBuilder::delegate or ink_env::invoke_contract_delegate, is being decoded incorrectly.

Description

Consider this minimal example:

// First contract, this will be performing a delegate call to the `Callee`.
#[ink(storage)]
pub struct Caller {
    value: u128,
}

#[ink(message)]
pub fn get_value(&self, callee_code_hash: Hash) -> u128 {
    let result = build_call::<DefaultEnvironment>()
        .delegate(callee_code_hash)
        .exec_input(ExecutionInput::new(Selector::new(ink::selector_bytes!(
            "get_value"
        ))))
        .returns::<u128>()
        .invoke();

    result
}

// Different contract, using this code hash for the delegate call.
#[ink(storage)]
pub struct Callee {
    value: u128,
}

#[ink(message)]
pub fn get_value(&self) -> u128 {
    self.value
}

In this example we are executing the Callee code in the context of the Caller contract. This means we'll be using the storage values of the Caller contract.

Running this code we expect the delegate call to return value as it was stored in the Caller contract. However, due to the reported bug a different value is returned (for the case of uints it is 256 times the expected value).

Impact

After conducting an analysis of the on-chain deployments of ink! contracts on Astar, Shiden, Aleph Zero, Amplitude and Pendulum, we have found that no contracts on those chains have been affected by the issue.

This bug was related to the mechanics around decoding a call's return buffer, which was changed as part of https://github.com/paritytech/ink/pull/1450. Since this feature was only released in ink! 4.0.0 no previous versions are affected.

Mitigations

If you have an ink! 4.x series contract, please update it to the 4.2.1 patch release that we just published.

Credits

Thank you Facundo Lerena from CoinFabrik for reporting this problem in a well-structured and responsible way.

Fixed in


          4.2.1

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 27, 2023

4.0.0 unknown

1 CVE

CVE-2023-34449 GHSA-853p-5678-hv8f Jun 14, 2023

ink! vulnerable to incorrect decoding of storage value when using `DelegateCall`

5.3 / 10

Medium

Network Low None None Unchanged None Low None

Summary

The return value when using delegate call mechanics, either through CallBuilder::delegate or ink_env::invoke_contract_delegate, is being decoded incorrectly.

Description

Consider this minimal example:

// First contract, this will be performing a delegate call to the `Callee`.
#[ink(storage)]
pub struct Caller {
    value: u128,
}

#[ink(message)]
pub fn get_value(&self, callee_code_hash: Hash) -> u128 {
    let result = build_call::<DefaultEnvironment>()
        .delegate(callee_code_hash)
        .exec_input(ExecutionInput::new(Selector::new(ink::selector_bytes!(
            "get_value"
        ))))
        .returns::<u128>()
        .invoke();

    result
}

// Different contract, using this code hash for the delegate call.
#[ink(storage)]
pub struct Callee {
    value: u128,
}

#[ink(message)]
pub fn get_value(&self) -> u128 {
    self.value
}

In this example we are executing the Callee code in the context of the Caller contract. This means we'll be using the storage values of the Caller contract.

Running this code we expect the delegate call to return value as it was stored in the Caller contract. However, due to the reported bug a different value is returned (for the case of uints it is 256 times the expected value).

Impact

After conducting an analysis of the on-chain deployments of ink! contracts on Astar, Shiden, Aleph Zero, Amplitude and Pendulum, we have found that no contracts on those chains have been affected by the issue.

This bug was related to the mechanics around decoding a call's return buffer, which was changed as part of https://github.com/paritytech/ink/pull/1450. Since this feature was only released in ink! 4.0.0 no previous versions are affected.

Mitigations

If you have an ink! 4.x series contract, please update it to the 4.2.1 patch release that we just published.

Credits

Thank you Facundo Lerena from CoinFabrik for reporting this problem in a well-structured and responsible way.

Fixed in


          4.2.1

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 15, 2023

4.0.0-rc unknown

Feb 01, 2023

4.0.0-beta.1 unknown

Jan 25, 2023

4.0.0-beta unknown

Nov 22, 2022

4.0.0-alpha.3 unknown

Sep 21, 2022

0.0.0 unknown

Oct 20, 2017

Activity

Details

Summary

Description

Impact

Mitigations

Credits

Summary

Description

Impact

Mitigations

Credits

Summary

Description

Impact

Mitigations

Credits

Summary

Description

Impact

Mitigations

Credits

Summary

Description

Impact

Mitigations

Credits