UltraDAG Core CVE-2026-42278

Exploitation requires the target smart account to have created at least one pocket-derived sub-address via the CreatePocket operation (SmartOpType::CreatePocket), which stores entries in the StateEngine's pocket_to_parent HashMap. The parent smart account must have configured a spending policy with at least one restriction: vault_threshold > 0 (requiring multi-round delays for large transfers), daily_limit set (capping total daily spending), or instant_limit < total pocket balance (forcing vault holds). Default UltraDAG smart account configurations without policies are not vulnerable to policy bypass (though they lack protection regardless). Attack execution requires the attacker to possess or compromise the parent account's signing key - this is the same key used for legitimate pocket operations, so the vulnerability does not introduce a new authentication surface but removes the policy enforcement layer. The flaw affects pocket-originated transfers only; transfers from parent addresses correctly enforce policies. Network accessibility of the blockchain node is required to submit SmartTransferTx transactions (AV:N), with no additional complexity beyond standard transaction submission (AC:L). No user interaction is needed beyond the attacker's transaction crafting (UI:N). The vulnerability is platform-independent, affecting all UltraDAG Core deployments (Linux, macOS, Windows) running affected Rust binary versions.

This represents critical real-world risk despite being blockchain-specific. CVSS 4.0 vector shows network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), with high integrity and availability impact (VI:H/VA:H) on the vulnerable system. Confirmed actively exploited per CISA KEV listing, indicating threat actors are draining funds in production environments. The attack is fully automatable - a script can enumerate all smart accounts with pockets (on-chain data), identify those with restrictive policies on the parent, and instantly transfer pocket balances without waiting for vault delays. While CVSS correctly identifies high impact, the real-world severity is amplified by financial loss: attackers can drain cryptocurrency holdings that users believed were protected by multi-day vault holds. SSVC assessment: Exploitation=active, Automatable=yes, Technical Impact=total (funds loss). The patch commit includes 265 lines of regression tests (smart_account_policy_pocket.rs), confirming vendor awareness of exploitation. Priority: immediate patching required for any node operator or wallet provider using UltraDAG smart accounts. No conflicting signals - all data sources align on critical severity and active exploitation.

An attacker enumerates UltraDAG blockchain state to identify smart accounts with both pockets and restrictive spending policies (e.g., a corporate treasury with 1 UDAG daily limit and 24-hour vault delay). The attacker crafts a SmartTransferTx with tx.from set to a pocket address under the target account and tx.to pointing to their own address. Because the attacker possesses the parent account's private key (legitimate user scenario) or has compromised it (attacker scenario), the transaction's signature verification passes. The StateEngine processes the transfer but fails to resolve the pocket to its parent during check_spending_policy, defaulting to no-policy enforcement. The entire pocket balance transfers instantly to the attacker's address, bypassing the intended 24-hour hold. Publicly available exploit code exists in the form of the detailed diff and regression tests, which demonstrate exact exploitation paths. The attack requires only network access to submit transactions to any UltraDAG node accepting SmartTransferTx submissions.