ismp-grandpa
GRANDPA consensus client for pallet-ismp
Activity
- Latest release
- 1w ago
- Total releases
- 20
- Cadence
- ~25 days
- Last 12 months
- 7
Details
- License
- Apache-2.0
- First release
- Sep 19, 2024
| Version | Released | |
|---|---|---|
2512.2.0
minor
|
2512.2.0
minor
Dependencies (12)
+ 4 more
Changelog
Compare changes
|
|
2606.0.0
unknown
|
2606.0.0
unknown
Dependencies (12)
+ 4 more
Changelog
Compare changes
|
|
2512.1.0
unknown
|
2512.1.0
unknown
Dependencies (12)
+ 4 more
Changelog
Compare changes
|
|
2512.0.0
unknown
yanked
|
2512.0.0
unknown
yanked
Dependencies (12)
+ 4 more
Changelog
Compare changes
|
|
2503.2.0
unknown
yanked
|
2503.2.0
unknown
yanked
Dependencies (12)
+ 4 more
Changelog
Compare changes
|
|
2503.1.1
unknown
yanked
|
2503.1.1
unknown
yanked
Dependencies (12)
+ 4 more
Changelog
Compare changes
|
|
2506.2.0
unknown
yanked
|
2506.2.0
unknown
yanked
Dependencies (12)
+ 4 more
Changelog
Compare changes
|
|
2506.1.0
unknown
yanked
|
2506.1.0
unknown
yanked
Dependencies (12)
+ 4 more
Changelog
Compare changes
|
|
2506.0.0
unknown
yanked
|
2506.0.0
unknown
yanked
Dependencies (12)
+ 4 more
Changelog
Compare changes
|
|
2503.1.0
unknown
yanked
|
2503.1.0
unknown
yanked
Dependencies (12)
+ 4 more
Changelog
Compare changes
|
|
2503.0.0
unknown
yanked
|
2503.0.0
unknown
yanked
Dependencies (12)
+ 4 more
Changelog
Compare changes
|
|
2412.0.0
unknown
yanked
|
2412.0.0
unknown
yanked
Dependencies (12)
+ 4 more
Changelog
Compare changes
|
|
16.0.0
unknown
yanked
|
16.0.0
unknown
yanked
Dependencies (12)
+ 4 more
Changelog
Compare changes
|
|
15.0.1
unknown
yanked
|
15.0.1
unknown
yanked
Dependencies (20)
+ 12 more
Changelog
Compare changes
|
|
15.0.0
unknown
yanked
1 CVE
CVE-2025-24800
GHSA-wwx5-gpgr-vxr7
Jan 28, 2025
ismp-grandpa crate accepted incorrect signatures
Critical
Network
Low
None
None
A critical vulnerability was discovered in the DescriptionThe vulnerability manifests as a verifer that only accepts incorrect signatures of Grandpa precommits and was introduced in this specific commit. Perhaps due to unfamiliarity with core substrate APIs. The This vulnerability remained undetected even with integration tests, as the prover was also misconfigured to initialize the Grandpa verifier with the incorrect authority But even more devastatingly, the verifier will also accept malicious GRANDPA signatures for any precommit message. This vulnerability has been fixed in this commit and a patch release has been published. ImpactThis could be used to steal funds or compromise other kinds of cross-chain applications. PatchesThis vulnerability has been fixed in the latest version of RecommendationsUsers who rely on the compromised versions must upgrade immediately, as all vulnerable versions of the crate has been yanked. Fixed in
15.0.1
References
Updated Jan 28, 2025 · Source: OSV.dev |
15.0.0
unknown
yanked
Dependencies (20)
+ 12 more
Changelog
Compare changes
|
|
1.15.4
unknown
yanked
1 CVE
CVE-2025-24800
GHSA-wwx5-gpgr-vxr7
Jan 28, 2025
ismp-grandpa crate accepted incorrect signatures
Critical
Network
Low
None
None
A critical vulnerability was discovered in the DescriptionThe vulnerability manifests as a verifer that only accepts incorrect signatures of Grandpa precommits and was introduced in this specific commit. Perhaps due to unfamiliarity with core substrate APIs. The This vulnerability remained undetected even with integration tests, as the prover was also misconfigured to initialize the Grandpa verifier with the incorrect authority But even more devastatingly, the verifier will also accept malicious GRANDPA signatures for any precommit message. This vulnerability has been fixed in this commit and a patch release has been published. ImpactThis could be used to steal funds or compromise other kinds of cross-chain applications. PatchesThis vulnerability has been fixed in the latest version of RecommendationsUsers who rely on the compromised versions must upgrade immediately, as all vulnerable versions of the crate has been yanked. Fixed in
15.0.1
References
Updated Jan 28, 2025 · Source: OSV.dev |
1.15.4
unknown
yanked
Dependencies (21)
+ 13 more
Changelog
Compare changes
|
|
1.15.3
unknown
yanked
1 CVE
CVE-2025-24800
GHSA-wwx5-gpgr-vxr7
Jan 28, 2025
ismp-grandpa crate accepted incorrect signatures
Critical
Network
Low
None
None
A critical vulnerability was discovered in the DescriptionThe vulnerability manifests as a verifer that only accepts incorrect signatures of Grandpa precommits and was introduced in this specific commit. Perhaps due to unfamiliarity with core substrate APIs. The This vulnerability remained undetected even with integration tests, as the prover was also misconfigured to initialize the Grandpa verifier with the incorrect authority But even more devastatingly, the verifier will also accept malicious GRANDPA signatures for any precommit message. This vulnerability has been fixed in this commit and a patch release has been published. ImpactThis could be used to steal funds or compromise other kinds of cross-chain applications. PatchesThis vulnerability has been fixed in the latest version of RecommendationsUsers who rely on the compromised versions must upgrade immediately, as all vulnerable versions of the crate has been yanked. Fixed in
15.0.1
References
Updated Jan 28, 2025 · Source: OSV.dev |
1.15.3
unknown
yanked
Dependencies (18)
+ 10 more
Changelog
Compare changes
|
|
1.15.2
unknown
yanked
1 CVE
CVE-2025-24800
GHSA-wwx5-gpgr-vxr7
Jan 28, 2025
ismp-grandpa crate accepted incorrect signatures
Critical
Network
Low
None
None
A critical vulnerability was discovered in the DescriptionThe vulnerability manifests as a verifer that only accepts incorrect signatures of Grandpa precommits and was introduced in this specific commit. Perhaps due to unfamiliarity with core substrate APIs. The This vulnerability remained undetected even with integration tests, as the prover was also misconfigured to initialize the Grandpa verifier with the incorrect authority But even more devastatingly, the verifier will also accept malicious GRANDPA signatures for any precommit message. This vulnerability has been fixed in this commit and a patch release has been published. ImpactThis could be used to steal funds or compromise other kinds of cross-chain applications. PatchesThis vulnerability has been fixed in the latest version of RecommendationsUsers who rely on the compromised versions must upgrade immediately, as all vulnerable versions of the crate has been yanked. Fixed in
15.0.1
References
Updated Jan 28, 2025 · Source: OSV.dev |
1.15.2
unknown
yanked
Dependencies (18)
+ 10 more
Changelog
Compare changes
|
|
1.15.1
unknown
yanked
1 CVE
CVE-2025-24800
GHSA-wwx5-gpgr-vxr7
Jan 28, 2025
ismp-grandpa crate accepted incorrect signatures
Critical
Network
Low
None
None
A critical vulnerability was discovered in the DescriptionThe vulnerability manifests as a verifer that only accepts incorrect signatures of Grandpa precommits and was introduced in this specific commit. Perhaps due to unfamiliarity with core substrate APIs. The This vulnerability remained undetected even with integration tests, as the prover was also misconfigured to initialize the Grandpa verifier with the incorrect authority But even more devastatingly, the verifier will also accept malicious GRANDPA signatures for any precommit message. This vulnerability has been fixed in this commit and a patch release has been published. ImpactThis could be used to steal funds or compromise other kinds of cross-chain applications. PatchesThis vulnerability has been fixed in the latest version of RecommendationsUsers who rely on the compromised versions must upgrade immediately, as all vulnerable versions of the crate has been yanked. Fixed in
15.0.1
References
Updated Jan 28, 2025 · Source: OSV.dev |
1.15.1
unknown
yanked
Dependencies (18)
+ 10 more
Changelog
Compare changes
|
|
1.15.0
unknown
yanked
1 CVE
CVE-2025-24800
GHSA-wwx5-gpgr-vxr7
Jan 28, 2025
ismp-grandpa crate accepted incorrect signatures
Critical
Network
Low
None
None
A critical vulnerability was discovered in the DescriptionThe vulnerability manifests as a verifer that only accepts incorrect signatures of Grandpa precommits and was introduced in this specific commit. Perhaps due to unfamiliarity with core substrate APIs. The This vulnerability remained undetected even with integration tests, as the prover was also misconfigured to initialize the Grandpa verifier with the incorrect authority But even more devastatingly, the verifier will also accept malicious GRANDPA signatures for any precommit message. This vulnerability has been fixed in this commit and a patch release has been published. ImpactThis could be used to steal funds or compromise other kinds of cross-chain applications. PatchesThis vulnerability has been fixed in the latest version of RecommendationsUsers who rely on the compromised versions must upgrade immediately, as all vulnerable versions of the crate has been yanked. Fixed in
15.0.1
References
Updated Jan 28, 2025 · Source: OSV.dev |
1.15.0
unknown
yanked
Dependencies (18)
+ 10 more
Changelog
|