Hydra: Deposit Claim omits Head state-token spending requirement
Impact
Hydra, a Cardano layer-two scalability solution, has a vulnerability in versions prior to 2.1.0 where the deposit claim process omits a required Head state-token spending check, allowing a third party to redirect assets. The issue can be exploited by building a Cardano transaction before the deposit deadline. It is fixed in version 2.1.0.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.It neither requires spending the Head state-token UTxO in the same transaction nor constrains outputs.
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
cardano-scaling · GitHub_M
hydra
1 range
cardano-scaling · GitHub_M
hydra
Compare with this publisher’s ranges. This does not inspect your installation.
affected
< 2.1.0
Other versions: unknown
Original source description
Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the Claim branch in hydra-plutus/validators/deposit.ak checks only that datum.head_id matches the attacker-controlled redeemer.currencySymbol and that the transaction is valid before the deposit deadline. It neither requires spending the Head state-token UTxO in the same transaction nor constrains outputs. After a deposit made through POST /commit is confirmed, any third party able to build a Cardano transaction can observe and consume the pending deposit UTxO before its deadline and redirect the assets to an arbitrary address. A standalone deposit spend invokes no Head validator, bypassing its safety checks; historical head-ID binding and the Aiken rewrite retained this missing invariant. The default deadline is three times depositPeriod, so the described attack applies to pending deposits before that deadline. This issue is fixed in version 2.1.0.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-62162View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changes- CVE · CVE-2026-62162
Observed 2026-10-30T22:48:04.762Z · upstream updated 2026-10-30T22:17:11.419Z
Prioritization updated
before
[]
after
[ { "source": "CISA-ADP", "type": "SSVC", "role": "CISA Coordinator", "timestamp": "2026-10-30T21:18:05.207328Z", "decisions": [ { "name": "Exploitation", "value": "none" }, { "name": "Automatable", "value": "no" }, { "name": "Technical Impact", "value": "partial" } ] } ]
Large field values are marked as truncated previews. Original source snapshots remain retained.
Showing up to 50 most recent observed changes.