CVE-2022-36447

Vulnerability

Overview

The Chia CAT1 Standard 1.0.0 contained a critical inflation vulnerability that allowed any holder of a CAT1 token to arbitrarily increase the total supply of that token [1][2]. The root cause was a flaw in the coin's validation logic that failed to properly enforce supply caps during token minting or transfer operations, enabling malicious actors to create tokens out of thin air [2].

Exploitation

No special privileges or network position were required; any entity holding even a single unit of any CAT1 token could exploit the bug [2]. The attack was performed by crafting a transaction that violated the intended supply constraints, and it was fully on-chain auditable, meaning the inflated coins could be identified by off-chain observers [2].

Impact

An attacker could inflate the total supply of any CAT1 token to any arbitrary amount, completely undermining the token's scarcity and value [1][2]. This affected every token issued under the CAT1 standard, regardless of its individual issuance rules [2].

Mitigation

The Chia team deprecated CAT1 at block height 2,311,760 (July 26, 2022) and released wallet version 1.5.0, which no longer supports CAT1 assets [1]. Token holders were advised to upgrade their wallets and await reissuance of assets under the new CAT2 standard, which fixed the vulnerability [1][3].