CVE-2025-54429

Executive Summary

CVE-2025-54429 is a security advisory affecting Polkadot Frontier, the Ethereum and EVM compatibility layer for Polkadot and Substrate. The vulnerability lies in the incorrect classification of account address types within the Frontier runtime. Specifically, the CallableByContract configuration check, which determines whether a precompiled contract can be invoked by a smart contract, was returning AddressType::EOA (Externally Owned Account) for contract addresses created via the CREATE or CREATE2 opcodes. This misclassification could allow smart contracts to bypass access controls intended to restrict certain precompiled contracts from being called by other contracts. The issue is not directly exploitable in any of the predefined precompiles in Frontier, but it poses a risk for custom precompile implementations that rely on the distinction between AddressType::EOA and AddressType::Contract. The vulnerability is fixed in commit 0822030.

Supply Chain & Package Security

This vulnerability is specific to the Polkadot Frontier runtime, which is a core component of the Polkadot ecosystem. It does not directly affect NPM, PyPI, Go, or Ruby packages. However, any project that uses a custom precompile implementation within Frontier and relies on the CallableByContract configuration should be considered at risk. The fix is available in the Frontier repository, and users are advised to update to the latest patched version.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely due to incomplete or missing CVSS vector data. Based on the nature of the vulnerability, a more realistic assessment would be:

• Attack Vector (AV): Network (AV:N) - The vulnerability can be triggered by sending a transaction to a smart contract.
• Attack Complexity (AC): Low (AC:L) - No special conditions are required.
• Privileges Required (PR): None (PR:N) - No authentication is needed.
• User Interaction (UI): None (UI:N) - No user action is required.
• Scope (S): Unchanged (S:U) - The vulnerable component is the only one affected.
• Confidentiality (C): Low (C:L) - Limited information disclosure may be possible.
• Integrity (I): Low (I:L) - Some data modification may be possible.
• Availability (A): Low (A:L) - Some service disruption may be possible.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Estimated Score: 7.3 (High)

Threat Level: High. While not directly exploitable in predefined precompiles, the vulnerability undermines a fundamental access control mechanism, potentially allowing unauthorized contract-to-contract calls in custom implementations.

Deep Dive & Mechanics

The vulnerability stems from the AddressType classification logic in Frontier. In the EVM, there are three main types of accounts:

• Externally Owned Accounts (EOA): Controlled by private keys.
• Smart Contract Accounts: Controlled by contract code.
• Precompiled Contracts: Built-in contracts at specific addresses.

Frontier uses a configuration flag CallableByContract to determine if a precompiled contract can be called by a smart contract. This flag is checked by the address_type() function, which returns the AddressType of the caller.

The bug was in the implementation of address_type() for contract addresses created via CREATE or CREATE2. Instead of returning AddressType::Contract, it incorrectly returned AddressType::EOA. This meant that the CallableByContract check would pass for these contract addresses, even if the precompile was not configured to be callable by contracts.

The fix in commit 0822030 corrects this by ensuring that contract addresses created via CREATE or CREATE2 are correctly identified as AddressType::Contract.

Vulnerable vs. Patched Code

The vulnerable code is in the address_type() function within Frontier's runtime. The exact location is in the frame/evm/src/address.rs file (or similar).

Vulnerable Code (Conceptual):

fn address_type(address: &H160) -> AddressType {
    if is_precompile(address) {
        return AddressType::Precompile;
    }
    if is_contract(address) {
        // BUG: Incorrectly returns EOA for CREATE/CREATE2 addresses
        return AddressType::EOA;
    }
    AddressType::EOA
}

Patched Code (Conceptual):

fn address_type(address: &H160) -> AddressType {
    if is_precompile(address) {
        return AddressType::Precompile;
    }
    if is_contract(address) {
        // FIX: Correctly returns Contract for CREATE/CREATE2 addresses
        return AddressType::Contract;
    }
    AddressType::EOA
}

The key difference is the return value for contract addresses. The patched code correctly returns AddressType::Contract, ensuring that the CallableByContract check works as intended.

Exploitation & Lab Setup

Red Team

Exploitation Scenario:

1. Setup: Deploy a custom precompile that is configured with CallableByContract = false (i.e., it should only be callable by EOAs).
2. Trigger: Deploy a smart contract that uses CREATE or CREATE2 to create another contract.
3. Exploit: The newly created contract (via CREATE/CREATE2) calls the custom precompile. Due to the bug, the precompile sees the caller as an EOA and allows the call, bypassing the intended restriction.

Lab Setup:

• Use a local Substrate node with Frontier enabled.
• Deploy a custom precompile with CallableByContract = false.
• Deploy a factory contract that uses CREATE to spawn a child contract.
• The child contract attempts to call the custom precompile.
• Observe that the call succeeds in the vulnerable version and fails in the patched version.

No exploit code is available from Exploit-DB.

Blue Team

Detection:

• Monitor for transactions where a contract created via CREATE or CREATE2 calls a precompile that is not configured to be callable by contracts.
• Look for anomalies in the address_type() function's behavior.

Hunting:

• Search for custom precompile implementations that rely on AddressType::EOA and AddressType::Contract distinctions.
• Review logs for unexpected precompile calls from contract addresses.

Indicators of Compromise (IOCs)

• Log Entries: Unexpected successful calls to precompiles that have CallableByContract = false from contract addresses.
• On-Chain Data: Transactions where a contract created via CREATE or CREATE2 interacts with a precompile that should be restricted.
• Runtime Errors: In patched versions, such calls will fail with an error indicating the precompile is not callable by contracts.

Detection Engineering

YARA Rule

rule Detect_CVE_2025_54429_Vulnerable_Code {
    meta:
        description = "Detects vulnerable Frontier code that misclassifies contract addresses as EOA"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54429"
    strings:
        $vuln_pattern = "AddressType::EOA" ascii wide nocase
        $contract_check = "is_contract" ascii wide nocase
    condition:
        $vuln_pattern and $contract_check
}

Sigma Rule

title: CVE-2025-54429 - Frontier AddressType Misclassification
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation attempts of CVE-2025-54429 by monitoring for unexpected precompile calls from contract addresses.
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: polkadot_frontier
detection:
    selection:
        event: "precompile_call"
        caller_type: "Contract"
        precompile_callable_by_contract: false
    condition: selection
falsepositives:
    - Legitimate calls if the precompile configuration is updated.
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-54429 - Frontier AddressType Misclassification"; flow:to_server; content:"|70 72 65 63 6f 6d 70 69 6c 65|"; distance:0; within:10; content:"|63 61 6c 6c 61 62 6c 65 5f 62 79 5f 63 6f 6e 74 72 61 63 74|"; distance:0; within:20; content:"|66 61 6c 73 65|"; distance:0; within:5; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Frontier: Apply the fix by updating to commit 0822030 or later.
2. Review Custom Precompiles: Audit any custom precompile implementations that use AddressType::EOA or AddressType::Contract to ensure they are not affected.

Long-Term Mitigations:

1. Code Review: Implement a code review process for any custom precompile implementations.
2. Testing: Add unit tests that verify the address_type() function returns the correct type for all account types.
3. Monitoring: Set up monitoring for unexpected precompile calls.

Patch Details:

• Fixed Version: Commit 0822030 in the Frontier repository.
• Patch URL: https://github.com/polkadot-js/frontier/commit/0822030

Valters IT Signature: This report was generated by Valters IT DevSecOps & CTI Expert System. All information is provided for authorized security assessment and defensive purposes only.