ink_env

Version	Released
`6.0.0-beta.1` unknown	Nov 13, 2025
`6.0.0-beta` unknown	Oct 29, 2025
`6.0.0-alpha` unknown	May 02, 2025
`5.1.1` unknown	Dec 04, 2024
`5.1.0` unknown	Nov 28, 2024
`5.0.0` unknown	Mar 11, 2024
`5.0.0-rc.3` unknown	Mar 08, 2024
`5.0.0-rc.2` unknown	Feb 28, 2024
`5.0.0-rc.1` unknown	Feb 09, 2024
`5.0.0-rc` unknown	Nov 30, 2023
`5.0.0-alpha` unknown	Sep 09, 2023
`4.3.0` unknown	Aug 24, 2023
`4.2.1` unknown	Jun 14, 2023
`4.2.0` unknown 1 CVE	Apr 20, 2023
`4.1.0` unknown 1 CVE	Mar 23, 2023
`4.0.1` unknown 1 CVE	Feb 27, 2023
`4.0.0` unknown 1 CVE	Feb 15, 2023
`4.0.0-rc` unknown	Feb 01, 2023
`4.0.0-beta.1` unknown	Jan 24, 2023
`4.0.0-beta` unknown	Nov 22, 2022
`3.4.0` unknown	Oct 21, 2022
`4.0.0-alpha.3` unknown	Sep 21, 2022
`4.0.0-alpha.1` unknown	Aug 24, 2022
`3.3.1` unknown	Aug 09, 2022
`3.3.0` unknown	Jun 22, 2022
`3.2.0` unknown	May 25, 2022
`3.1.0` unknown	May 18, 2022
`3.0.1` unknown	Apr 05, 2022
`3.0.0` unknown	Mar 17, 2022
`3.0.0-rc9` unknown	Feb 23, 2022
`3.0.0-rc8` unknown	Jan 20, 2022
`3.0.0-rc7` unknown	Nov 25, 2021
`3.0.0-rc6` unknown	Oct 18, 2021
`3.0.0-rc5` unknown	Sep 09, 2021
`3.0.0-rc4` unknown	Jul 22, 2021
`3.0.0-rc3` unknown	Mar 02, 2021
`3.0.0-rc2` unknown	Oct 22, 2020
`3.0.0-rc1` unknown	Oct 09, 2020
`0.0.0` unknown yanked	Mar 18, 2020

6.0.0-beta.1 unknown

Nov 13, 2025

6.0.0-beta unknown

Oct 29, 2025

6.0.0-alpha unknown

May 02, 2025

5.1.1 unknown

Dec 04, 2024

5.1.0 unknown

Nov 28, 2024

5.0.0 unknown

Mar 11, 2024

5.0.0-rc.3 unknown

Mar 08, 2024

5.0.0-rc.2 unknown

Feb 28, 2024

5.0.0-rc.1 unknown

Feb 09, 2024

5.0.0-rc unknown

Nov 30, 2023

5.0.0-alpha unknown

Sep 09, 2023

4.3.0 unknown

Aug 24, 2023

4.2.1 unknown

Jun 14, 2023

4.2.0 unknown

1 CVE

CVE-2023-34449 GHSA-853p-5678-hv8f Jun 14, 2023

ink! vulnerable to incorrect decoding of storage value when using `DelegateCall`

5.3 / 10

Medium

Network Low None None Unchanged None Low None

Summary

The return value when using delegate call mechanics, either through CallBuilder::delegate or ink_env::invoke_contract_delegate, is being decoded incorrectly.

Description

Consider this minimal example:

// First contract, this will be performing a delegate call to the `Callee`.
#[ink(storage)]
pub struct Caller {
    value: u128,
}

#[ink(message)]
pub fn get_value(&self, callee_code_hash: Hash) -> u128 {
    let result = build_call::<DefaultEnvironment>()
        .delegate(callee_code_hash)
        .exec_input(ExecutionInput::new(Selector::new(ink::selector_bytes!(
            "get_value"
        ))))
        .returns::<u128>()
        .invoke();

    result
}

// Different contract, using this code hash for the delegate call.
#[ink(storage)]
pub struct Callee {
    value: u128,
}

#[ink(message)]
pub fn get_value(&self) -> u128 {
    self.value
}

In this example we are executing the Callee code in the context of the Caller contract. This means we'll be using the storage values of the Caller contract.

Running this code we expect the delegate call to return value as it was stored in the Caller contract. However, due to the reported bug a different value is returned (for the case of uints it is 256 times the expected value).

Impact

After conducting an analysis of the on-chain deployments of ink! contracts on Astar, Shiden, Aleph Zero, Amplitude and Pendulum, we have found that no contracts on those chains have been affected by the issue.

This bug was related to the mechanics around decoding a call's return buffer, which was changed as part of https://github.com/paritytech/ink/pull/1450. Since this feature was only released in ink! 4.0.0 no previous versions are affected.

Mitigations

If you have an ink! 4.x series contract, please update it to the 4.2.1 patch release that we just published.

Credits

Thank you Facundo Lerena from CoinFabrik for reporting this problem in a well-structured and responsible way.

Fixed in


          4.2.1

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 20, 2023

4.1.0 unknown

1 CVE

CVE-2023-34449 GHSA-853p-5678-hv8f Jun 14, 2023

ink! vulnerable to incorrect decoding of storage value when using `DelegateCall`

5.3 / 10

Medium

Network Low None None Unchanged None Low None

Summary

The return value when using delegate call mechanics, either through CallBuilder::delegate or ink_env::invoke_contract_delegate, is being decoded incorrectly.

Description

Consider this minimal example:

// First contract, this will be performing a delegate call to the `Callee`.
#[ink(storage)]
pub struct Caller {
    value: u128,
}

#[ink(message)]
pub fn get_value(&self, callee_code_hash: Hash) -> u128 {
    let result = build_call::<DefaultEnvironment>()
        .delegate(callee_code_hash)
        .exec_input(ExecutionInput::new(Selector::new(ink::selector_bytes!(
            "get_value"
        ))))
        .returns::<u128>()
        .invoke();

    result
}

// Different contract, using this code hash for the delegate call.
#[ink(storage)]
pub struct Callee {
    value: u128,
}

#[ink(message)]
pub fn get_value(&self) -> u128 {
    self.value
}

In this example we are executing the Callee code in the context of the Caller contract. This means we'll be using the storage values of the Caller contract.

Running this code we expect the delegate call to return value as it was stored in the Caller contract. However, due to the reported bug a different value is returned (for the case of uints it is 256 times the expected value).

Impact

After conducting an analysis of the on-chain deployments of ink! contracts on Astar, Shiden, Aleph Zero, Amplitude and Pendulum, we have found that no contracts on those chains have been affected by the issue.

This bug was related to the mechanics around decoding a call's return buffer, which was changed as part of https://github.com/paritytech/ink/pull/1450. Since this feature was only released in ink! 4.0.0 no previous versions are affected.

Mitigations

If you have an ink! 4.x series contract, please update it to the 4.2.1 patch release that we just published.

Credits

Thank you Facundo Lerena from CoinFabrik for reporting this problem in a well-structured and responsible way.

Fixed in


          4.2.1

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 23, 2023

4.0.1 unknown

1 CVE

CVE-2023-34449 GHSA-853p-5678-hv8f Jun 14, 2023

ink! vulnerable to incorrect decoding of storage value when using `DelegateCall`

5.3 / 10

Medium

Network Low None None Unchanged None Low None

Summary

The return value when using delegate call mechanics, either through CallBuilder::delegate or ink_env::invoke_contract_delegate, is being decoded incorrectly.

Description

Consider this minimal example:

// First contract, this will be performing a delegate call to the `Callee`.
#[ink(storage)]
pub struct Caller {
    value: u128,
}

#[ink(message)]
pub fn get_value(&self, callee_code_hash: Hash) -> u128 {
    let result = build_call::<DefaultEnvironment>()
        .delegate(callee_code_hash)
        .exec_input(ExecutionInput::new(Selector::new(ink::selector_bytes!(
            "get_value"
        ))))
        .returns::<u128>()
        .invoke();

    result
}

// Different contract, using this code hash for the delegate call.
#[ink(storage)]
pub struct Callee {
    value: u128,
}

#[ink(message)]
pub fn get_value(&self) -> u128 {
    self.value
}

In this example we are executing the Callee code in the context of the Caller contract. This means we'll be using the storage values of the Caller contract.

Running this code we expect the delegate call to return value as it was stored in the Caller contract. However, due to the reported bug a different value is returned (for the case of uints it is 256 times the expected value).

Impact

After conducting an analysis of the on-chain deployments of ink! contracts on Astar, Shiden, Aleph Zero, Amplitude and Pendulum, we have found that no contracts on those chains have been affected by the issue.

This bug was related to the mechanics around decoding a call's return buffer, which was changed as part of https://github.com/paritytech/ink/pull/1450. Since this feature was only released in ink! 4.0.0 no previous versions are affected.

Mitigations

If you have an ink! 4.x series contract, please update it to the 4.2.1 patch release that we just published.

Credits

Thank you Facundo Lerena from CoinFabrik for reporting this problem in a well-structured and responsible way.

Fixed in


          4.2.1

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 27, 2023

4.0.0 unknown

1 CVE

CVE-2023-34449 GHSA-853p-5678-hv8f Jun 14, 2023

ink! vulnerable to incorrect decoding of storage value when using `DelegateCall`

5.3 / 10

Medium

Network Low None None Unchanged None Low None

Summary

The return value when using delegate call mechanics, either through CallBuilder::delegate or ink_env::invoke_contract_delegate, is being decoded incorrectly.

Description

Consider this minimal example:

// First contract, this will be performing a delegate call to the `Callee`.
#[ink(storage)]
pub struct Caller {
    value: u128,
}

#[ink(message)]
pub fn get_value(&self, callee_code_hash: Hash) -> u128 {
    let result = build_call::<DefaultEnvironment>()
        .delegate(callee_code_hash)
        .exec_input(ExecutionInput::new(Selector::new(ink::selector_bytes!(
            "get_value"
        ))))
        .returns::<u128>()
        .invoke();

    result
}

// Different contract, using this code hash for the delegate call.
#[ink(storage)]
pub struct Callee {
    value: u128,
}

#[ink(message)]
pub fn get_value(&self) -> u128 {
    self.value
}

In this example we are executing the Callee code in the context of the Caller contract. This means we'll be using the storage values of the Caller contract.

Running this code we expect the delegate call to return value as it was stored in the Caller contract. However, due to the reported bug a different value is returned (for the case of uints it is 256 times the expected value).

Impact

After conducting an analysis of the on-chain deployments of ink! contracts on Astar, Shiden, Aleph Zero, Amplitude and Pendulum, we have found that no contracts on those chains have been affected by the issue.

This bug was related to the mechanics around decoding a call's return buffer, which was changed as part of https://github.com/paritytech/ink/pull/1450. Since this feature was only released in ink! 4.0.0 no previous versions are affected.

Mitigations

If you have an ink! 4.x series contract, please update it to the 4.2.1 patch release that we just published.

Credits

Thank you Facundo Lerena from CoinFabrik for reporting this problem in a well-structured and responsible way.

Fixed in


          4.2.1

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 15, 2023

4.0.0-rc unknown

Feb 01, 2023

4.0.0-beta.1 unknown

Jan 24, 2023

4.0.0-beta unknown

Nov 22, 2022

3.4.0 unknown

Oct 21, 2022

4.0.0-alpha.3 unknown

Sep 21, 2022

4.0.0-alpha.1 unknown

Aug 24, 2022

3.3.1 unknown

Aug 09, 2022

3.3.0 unknown

Jun 22, 2022

3.2.0 unknown

May 25, 2022

3.1.0 unknown

May 18, 2022

3.0.1 unknown

Apr 05, 2022

3.0.0 unknown

Mar 17, 2022

3.0.0-rc9 unknown

Feb 23, 2022

3.0.0-rc8 unknown

Jan 20, 2022

3.0.0-rc7 unknown

Nov 25, 2021

3.0.0-rc6 unknown

Oct 18, 2021

3.0.0-rc5 unknown

Sep 09, 2021

3.0.0-rc4 unknown

Jul 22, 2021

3.0.0-rc3 unknown

Mar 02, 2021

3.0.0-rc2 unknown

Oct 22, 2020

3.0.0-rc1 unknown

Oct 09, 2020

0.0.0 unknown yanked

Mar 18, 2020

Activity

Details

Summary

Description

Impact

Mitigations

Credits

Summary

Description

Impact

Mitigations

Credits

Summary

Description

Impact

Mitigations

Credits

Summary

Description

Impact

Mitigations

Credits

Summary

Description

Impact

Mitigations

Credits