Live › vulnerability › CVE-2026-62162
Hydra, a Cardano layer-two scalability solution, has a deposit validator that does not check that the Head state-token UTxO is spent in the same transaction. Before the deposit deadline, any party able to build a Cardano transaction can consume a pending deposit and send the assets to an arbitrary address.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Teams running a Hydra Head on Cardano with versions before 2.1.0 that accept deposits through POST /commit. Exposure exists only while a deposit is pending and before its deadline. Teams not running Hydra, or not using deposits, can skip it.
No product ranges from the sources yet.
hydra-node --version (unknown if the sources give a command for this).POST /commit that are still pending, before the deposit deadline (three times depositPeriod by default).2.1.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the Claim branch in hydra-plutus/validators/deposit.ak checks only that datum.head_id matches the attacker-controlled redeemer.currencySymbol and that the transaction is valid before the deposit deadline. It neither requires spending the Head state-token UTxO in the same transaction nor constrains outputs. After a deposit made through POST /commit is confirmed, any third party able to build a Cardano transaction can observe and consume the pending deposit UTxO before its deadline and redirect the assets to an arbitrary address. A standalone deposit spend invokes no Head validator, bypassing its safety checks; historical head-ID binding and the Aiken rewrite retained this missing invariant. The default deadline is three times depositPeriod, so the described attack applies to pending deposits before that deadline. This issue is fixed in version 2.1.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-62162")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.