Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. In versions prior to commit 36f70d1, the Curve25519Add and Curve25519ScalarMul precompiles incorrectly handle invalid Ristretto point representations. Instead of returning an error, they silently treat invalid input bytes as the Ristretto identity element, leading to potentially incorrect cryptographic results. This is fixed in commit 36f70d1.
The Curve25519Add and Curve25519ScalarMul precompiles, which are part of the EVM compatibility layer in Polkadot Frontier, do not verify the correctness of passed bytes as Ristretto curve points. When an attacker or faulty application supplies invalid bytes representing a point, instead of raising an error, the identity element of the Ristretto group is silently substituted. As a result, cryptographic operations return results that do not reflect the intended input data, which constitutes a violation of secure cryptographic algorithm usage principles (CWE-327 — use of broken or risky cryptographic algorithm).
An attacker can supply crafted input data causing cryptographic operations based on Curve25519/Ristretto curve to return incorrect results, which may lead to circumvention of cryptographic protections or manipulation of application state using these precompiles in the EVM environment.
Polkadot Frontier should be updated to a version containing commit 36f70d1 (or later), which implements proper validation of Ristretto points and error returns for invalid input data. Details available in vendor references (GitHub Security Advisory GHSA-v4q3-23rh-w5mw).
Polkadot Frontier — all versions before commit 36f70d1 containing Curve25519Add and Curve25519ScalarMul precompiles
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X