polkadot-evm frontier check_inherent Target calculation

Summaryinfo

A vulnerability, which was classified as critical, has been found in polkadot-evm frontier. This vulnerability affects the function check_inherent. The manipulation of the argument Target leads to calculation. This vulnerability is traded as CVE-2025-54427. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in polkadot-evm frontier (affected version unknown). It has been rated as critical. This issue affects the function check_inherent. The manipulation of the argument target with an unknown input leads to a calculation vulnerability. Using CWE to declare the problem leads to CWE-682. The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management. Impacted is integrity, and availability. The summary by CVE is:

Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. The extrinsic note_min_gas_price_target is an inherent extrinsic, meaning only the block producer can call it. To ensure correctness, the ProvideInherent trait should be implemented for each inherent, which includes the check_inherent call. This allows other nodes to verify if the input (in this case, the target value) is correct. However, prior to commit a754b3d, the check_inherent function has not been implemented for note_min_gas_price_target. This lets the block producer set the target value without verification. The target is then used to set the MinGasPrice, which has an upper and lower bound defined in the on_initialize hook. The block producer can set the target to the upper bound. Which also increases the upper and lower bounds for the next block. Over time, this could result in continuously raising the gas price, making contract execution too expensive and ineffective for users. An attacker could use this flaw to manipulate the gas price, potentially leading to significantly inflated transaction fees. Such manipulation could render contract execution prohibitively expensive for users, effectively resulting in a denial-of-service condition for the network. This is fixed in version a754b3d.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2025-54427 since 07/22/2025. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

Applying the patch a754b3dc6e1b6da98f71aea7bb1fa08677b24186 is able to eliminate this problem. The bugfix is ready for download at github.com.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• polkadot-evm

Name

• frontier

License

• open-source

Website

• Product: https://github.com/polkadot-evm/frontier/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion