mpl-candy-machine

Activity

Latest release: 3y ago
Total releases: 18
Cadence: ~10 days
Last 12 months: 0

Details

License: non-standard
First release: Jan 25, 2022

Releases

Version	Released
`4.5.1` unknown	Feb 02, 2023
`4.6.0` unknown	Feb 02, 2023
`4.5.0` unknown 1 CVE	Oct 13, 2022
`4.4.1` unknown	Oct 04, 2022
`4.4.0` unknown	Sep 22, 2022
`4.3.2` unknown	Sep 08, 2022
`4.3.1` unknown	Sep 07, 2022
`4.3.0` unknown	Aug 30, 2022
`4.2.0` unknown	Aug 24, 2022
`4.1.1` unknown	Aug 23, 2022
`4.1.0` unknown	Aug 12, 2022
`4.0.2` unknown	Jul 05, 2022
`4.0.1` unknown	Jun 28, 2022
`4.0.0` unknown	May 31, 2022
`3.1.1` unknown	Mar 11, 2022
`3.1.0` unknown	Mar 03, 2022
`3.0.0` unknown	Feb 09, 2022
`2.0.1` unknown	Jan 25, 2022

Dependencies (14)

Depends on

4.5.1

Used by

Supply-chain exposure

3 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Vulnerable dependencies

1 of 14

arrayref critical 2 CVEs

These dependencies are still vulnerable in their latest release. Whether the exact version this package pins is affected isn't checked yet.

Known CVEs (1)

GHSA-9v25-r5q2-2p6w Dec 12, 2022

Candy Machine Set Collection During Mint Missing Check

Medium

A problem with Candy Machine V2 allow minting NFTs to an arbitrary collection due to a missing check.

Here is a description of the exploit: Details: Here is the tx/ix to exploit: Transaction: Ix 1: candy_machine v2, mint_nft, passing in empty metadata -1 Ix 2: custom handler, 0 cpi A --> token_metadata create_metadata_account, creates NFT cpi B --> candy_machine v2, set_collection_during_mint Ix 1 passes our first check for empty metadata, but eventually will hit a bot tax and return Ok. We do have a CPI check in this function but even if we hit that or moved it to the top, it returns Ok as a bot tax and still enables the issue. Ix 2, cpi A is Ok and mints an arbitrary NFT. Ix 2, cpi B checks the previous instruction using index_relative_to_current-1. This turns out to be Ix 1 which was Ok, so then your newly minted arbitrary NFT is successfully added to the collection. Conclusion: Candy machine could be out of NFTs and it still works. If the CM is closed, (we think?) it doesn't get to the check. The fix needs to be in set_collection_during_mint that current program ID id candy_machine_v2. It checks previous program ID but doesn't check current.

NOTE: THIS DOES NOT AFFECT Cmv3

Affected versions

4.5.0

Fixed in

4.5.1

References

https://github.com/metaplex-foundation/metaplex-program-library/security/advisories/GHSA-9v25-r5q2-2p6w
https://github.com/metaplex-foundation/metaplex-program-library/commit/e6b3aff603ac06236bf77c2ec21ead93c6836dce
https://github.com/metaplex-foundation/metaplex-program-library

Updated Dec 12, 2022 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

unknown 18

18 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More