Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Poseidon V1 variable-length input collision via implicit zero-padding
Vulnerability Description
soroban-poseidon provides Poseidon and Poseidon2 cryptographic hash functions for Soroban smart contracts. Poseidon V1 (PoseidonSponge) accepts variable-length inputs without injective padding. When a caller provides fewer inputs than the sponge rate (inputs.len() < T - 1), unused rate positions are implicitly zero-filled. This allows trivial hash collisions: for any input vector [m1, ..., mk] hashed with a sponge of rate > k, hash([m1, ..., mk]) equals hash([m1, ..., mk, 0]) because both produce identical pre-permutation states. This affects any use of PoseidonSponge or poseidon_hash where the number of inputs is less than T - 1 (e.g., hashing 1 input with T=3). Poseidon2 (Poseidon2Sponge) is not affected.
CVSS Information
N/A
Vulnerability Type
可逆的单向哈希
Vulnerability Title
soroban-poseidon 安全漏洞
Vulnerability Description
soroban-poseidon是Stellar开源的一个用于智能合约的Poseidon哈希函数库。 soroban-poseidon存在安全漏洞，该漏洞源于Poseidon V1接受可变长度输入而未使用单射填充，可能导致简单的哈希冲突。
CVSS Information
N/A
Vulnerability Type
N/A