GHSA-2gw2-qgjg-xh6p
Namada-apps allows Post-Genesis Validator Bypass
GHSA-2gw2-qgjg-xh6p is a vulnerability with no CVSS score yet in namada-apps, published February 20, 2025. No source lists public exploit code. Fixed in namada-apps 1.1.0.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.1.0namada-apps +1 more
Description
Impact
Ledger crash. A user is able to initialize a post-genesis validator with a negative commission rate using the --force flag. If this validator gets into the consensus set, then when computing PoS inflation inside fn update_rewards_products_and_mint_inflation, an instance of mul_floor will cause the return of an Err, which causes finalize_block to error.
Patches
This issue has been patched in apps version 1.1.0. The PoS validity predicate now enforces that the commission rate is not negative and any transaction that fails the check will be rejected, both for newly initialized validators and for commission rate change of an existing validator.
Workarounds
There are no workarounds and users are advised to upgrade.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
namada-appscrates.io | 1.0.0 to 1.0.0 | 1.1.0 |
namada-appscrates.io | 1.0.0 up to 1.1.0 | 1.1.0 |
What each source reports
GitHub AdvisoriesNo score
Namada-apps allows Post-Genesis Validator Bypass
Impact
Ledger crash. A user is able to initialize a post-genesis validator with a negative commission rate using the --force flag. If this validator gets into the consensus set, then when computing PoS inflation inside fn update_rewards_products_and_mint_inflation, an instance of mul_floor will cause the return of an Err, which causes finalize_block to error.
Patches
This issue has been patched in apps version 1.1.0. The PoS validity predicate now enforces that the commission rate is not negative and any transaction that fails the check will be rejected, both for newly initialized validators and for commission rate change of an existing validator.
Workarounds
There are no workarounds and users are advised to upgrade.
- Record
GHSA-2gw2-qgjg-xh6p- Weakness
- CWE-248
- Updated
- 2026-11-02
OSVNo score
Namada-apps allows Post-Genesis Validator Bypass
Impact
Ledger crash. A user is able to initialize a post-genesis validator with a negative commission rate using the --force flag. If this validator gets into the consensus set, then when computing PoS inflation inside fn update_rewards_products_and_mint_inflation, an instance of mul_floor will cause the return of an Err, which causes finalize_block to error.
Patches
This issue has been patched in apps version 1.1.0. The PoS validity predicate now enforces that the commission rate is not negative and any transaction that fails the check will be rejected, both for newly initialized validators and for commission rate change of an existing validator.
Workarounds
There are no workarounds and users are advised to upgrade.
- Record
GHSA-2gw2-qgjg-xh6p- Weakness
- CWE-248
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.