CVE-2022-39354
evm has incorrect is_static parameter for custom stateful precompiles
SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine. A custom stateful precompile can use the is_static parameter to determine if the call is executed in a static context (via STATICCALL), and thus decide if stateful operations should be done. Prior to version 0.36.0, the passed is_static parameter was incorrect -- it was only set to true if the call came from a direct STATICCALL opcode. However, once a static call context is entered, it should stay static. The issue only impacts custom precompiles that actually uses is_static. For those affected, the issue can lead to possible incorrect state transitions. Version 0.36.0 contains a patch. There are no known workarounds.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
evm has incorrect is_static parameter for custom stateful precompiles
SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine. A custom stateful precompile can use the is_static parameter to determine if the call is executed in a static context (via STATICCALL), and thus decide if stateful operations should be done. Prior to version 0.36.0, the passed is_static parameter was incorrect -- it was only set to true if the call came from a direct STATICCALL opcode. However, once a static call context is entered, it should stay static. The issue only impacts custom precompiles that actually uses is_static. For those affected, the issue can lead to possible incorrect state transitions. Version 0.36.0 contains a patch. There are no known workarounds.
- Record
CVE-2022-39354- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-670
- Updated
- 2026-11-02
EUVDEUVD-2022-7106
SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine. A custom stateful precompile can use the is_static parameter to determine if the call is executed in a static context (via STATICCALL), and thus decide if stateful operations should be done. Prior to version 0.36.0, the passed is_static parameter was incorrect -- it was only set to true if the call came from a direct STATICCALL opcode. However, once a static call context is entered, it should stay static. The issue only impacts custom precompiles that actually uses is_static. For those affected, the issue can lead to possible incorrect state transitions. Version 0.36.0 contains a patch. There are no known workarounds.
- Record
EUVD-2022-7106- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hhc4-47rh-cr34
Incorrect is_static parameter for custom stateful precompiles in SputnikVM (evm)
Impact
A custom stateful precompile can use the is_static parameter to determine if the call is executed in a static context (via STATICCALL), and thus decide if stateful operations should be done. Previously, the passed is_static parameter was incorrect -- it was only set to true if the call comes from a direct STATICCALL opcode. However, once a static call context is entered, it should stay static.
The issue only impacts custom precompiles that actually uses is_static. The maintainers estimate the usage is low. However, for those affected, it can lead to possible incorrect state transitions.
Patches
PR: https://github.com/rust-blockchain/evm/pull/133 Released in v0.36.0.
Older patch versions can be released on request if anyone needs them. Simply contact @sorpaas by email to request it.
For more information
If you have any questions or comments about this advisory:
- Open an issue in evm repo
- Email Wei at [email protected]
- Record
GHSA-hhc4-47rh-cr34- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-670
- Updated
- 2026-11-02
NVD
SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine. A custom stateful precompile can use the is_static parameter to determine if the call is executed in a static context (via STATICCALL), and thus decide if stateful operations should be done. Prior to version 0.36.0, the passed is_static parameter was incorrect -- it was only set to true if the call came from a direct STATICCALL opcode. However, once a static call context is entered, it should stay static. The issue only impacts custom precompiles that actually uses is_static. For those affected, the issue can lead to possible incorrect state transitions. Version 0.36.0 contains a patch. There are no known workarounds.
- Record
CVE-2022-39354- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-670
- Updated
- 2026-11-02
OSVGHSA-hhc4-47rh-cr34
Incorrect is_static parameter for custom stateful precompiles in SputnikVM (evm)
Impact
A custom stateful precompile can use the is_static parameter to determine if the call is executed in a static context (via STATICCALL), and thus decide if stateful operations should be done. Previously, the passed is_static parameter was incorrect -- it was only set to true if the call comes from a direct STATICCALL opcode. However, once a static call context is entered, it should stay static.
The issue only impacts custom precompiles that actually uses is_static. The maintainers estimate the usage is low. However, for those affected, it can lead to possible incorrect state transitions.
Patches
PR: https://github.com/rust-blockchain/evm/pull/133 Released in v0.36.0.
Older patch versions can be released on request if anyone needs them. Simply contact @sorpaas by email to request it.
For more information
If you have any questions or comments about this advisory:
- Open an issue in evm repo
- Email Wei at [email protected]
- Record
GHSA-hhc4-47rh-cr34- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-670
- Updated
- 2026-11-02
OSVRUSTSEC-2022-0083
evm incorrect state transition
SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine.
A custom stateful precompile can use the is_static parameter to determine if
the call is executed in a static context (via STATICCALL), and thus decide
if stateful operations should be done.
Prior to version 0.36.0, the passed is_static parameter was incorrect -- it
was only set to true if the call came from a direct STATICCALL opcode.
However, once a static call context is entered, it should stay static. The issue
only impacts custom precompiles that actually uses is_static.
For those affected, the issue can lead to possible incorrect state transitions.
- Record
RUSTSEC-2022-0083- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-39354 is a medium vulnerability (CVSS 5.9) in Evm Project Evm, published October 25, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.68%, the 52nd percentile. Fixed in evm 0.36.0.