CVE-2026-106511

Summary

The vulnerability allows any account with the Proposer role to perform explicitly barred actions, draining the contract's balance in two transactions with zero signatures.

Exploitability

Exploitation is relatively straightforward given the preconditions of having the Proposer role and the ability to execute two transactions without signatures.

Blast radius

If exploited, the vulnerability could result in the complete draining of the contract's EGLD/ESDT balance, leading to significant financial loss.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to the fixed version 1.2.3 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.