CVE-2026-40583

UNKNOWN 0.0

UltraDAG: SmartOp Vote Path Triggers Fatal Supply Invariant Halt

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

UltraDAG is a minimal DAG-BFT blockchain in Rust. In version 0.1, a non-council attacker can submit a signed SmartOp::Vote transaction that passes signature, nonce, and balance prechecks, but fails authorization only after state mutation has already occurred.

CWE	CWE-460 CWE-696
Vendor	ultradagcom
Product	core
Published	Apr 21, 2026

Stay Ahead of the Next One

Get instant alerts for ultradagcom core

Be the first to know when new unknown vulnerabilities affecting ultradagcom core are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

UltraDAGcom / core

= 0.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/UltraDAGcom/core/security/advisories/GHSA-q8wx-2crx-c7pp github.com: https://github.com/UltraDAGcom/core/commit/2f5a3a237ea519b48d71e6e3093c89f60694c7be github.com: https://github.com/UltraDAGcom/core/commit/45bcf7064741897319b6196d3d9f9e1307093511