GHSA-8724-5xmm-w5xqLowCVSS 3.7

CosmWasm affected by arithmetic overflows

Published
April 24, 2024
Last Modified
July 28, 2025

🔗 CVE IDs covered (1)

CVE-2024-58263 →

📋 Description

Some mathematical operations in cosmwasm-std use wrapping math instead of panicking on overflow for very big numbers. This can lead to wrong calculations in contracts that use these operations.

Affected functions:

  • Uint{256,512}::pow / Int{256,512}::pow
  • Int{256,512}::neg

Affected if overflow-checks = true is not set:

  • Uint{64,128}::pow / Int{64,128}::pow
  • Int{64,128}::neg

🎯 Affected products3

  • rust/cosmwasm-std:>= 1.3.0, < 1.4.4
  • rust/cosmwasm-std:>= 1.5.0, < 1.5.4
  • rust/cosmwasm-std:>= 2.0.0, < 2.0.2

🔗 References (7)