CVE-2022-36447 json
chia-blockchain tokens can be inflated to an arbitrary extent
published 2022-07-29 4 y ago modified 2026-06-17 4 mo ago also GHSA-pvjg-jwp3-mrj5 , PYSEC-2022-43072 , EUVD-2022-0369
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 58%
- public exploits
- 0
- none known
Summary
An inflation issue was discovered in Chia Network CAT1 Standard 1.0.0. Previously minted tokens minted on the Chia blockchain using the CAT1 standard can be inflated to an arbitrary extent by any holder of any amount of the token. The total amount of the token can be increased as high as the malicious actor pleases. This is true for every CAT1 on the Chia blockchain regardless of issuance rules. This attack is auditable on chain, so maliciously altered coins can potentially be marked by off-chain observers as malicious.
Exploit prediction
0.86% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | chia-blockchain | <=2.4.4rc3 |
no fix listed |
References
-
chia.net
web, vendor-advisory, advisory
-
chia.net
/2022/07/25/upgrading-the-cat-standard.en.html
web, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-36447
advisory
-
github.com
/Chia-Network/chia-blockchain
package
-
github.com
/pypa/advisory-database/tree/main/vulns/chia-blockchain/PYSEC-2022-43072.yaml
web
Sources
- CVE List CVE-2022-36447
- GitHub Advisory GHSA-pvjg-jwp3-mrj5
- NVD CVE-2022-36447
- OSV PYSEC-2022-43072
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.