EUVD-2026-19742Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Smart contract Marginal v1 performs unsafe downcast, allowing attackers to settle a large debt position for a negligible asset cost.
AnalysisAI
Marginal v1 smart contract implements an unsafe numeric downcast that enables attackers to settle large debt positions using negligible asset amounts, creating a critical financial manipulation vector in the DeFi protocol. The vulnerability affects Marginal Smart Contract v1 across all deployment instances accessible via the public blockchain network. An attacker can exploit this type confusion flaw to bypass intended collateral requirements and artificially close positions at drastically undervalued rates, causing financial loss to the protocol and legitimate liquidity providers.
Technical ContextAI
The vulnerability stems from CWE-681 (Incorrect Conversion Between Numeric Types), a class of flaws where unsafe casting between integer types-particularly downcasting from larger to smaller numeric representations-can cause precision loss or overflow conditions. In smart contracts, this commonly occurs when solidity code casts uint256 values to uint128, uint64, or smaller types without proper range validation. The Marginal protocol's position settlement logic appears to perform such a downcast on debt or collateral values during the debt closure operation, truncating significant digits and allowing an attacker to specify a tiny asset amount that, when downcast, matches a much larger debt obligation. This is particularly dangerous in DeFi where position sizing and collateral requirements enforce protocol solvency.
RemediationAI
Patch the unsafe downcast by implementing strict range validation before any numeric type conversion. Specifically, verify that source values fall within the valid range of the target type before casting; for example, if downcasting uint256 debt to uint128, assert debt ≤ type(uint128).max before performing the cast. Additionally, review all arithmetic operations in the position settlement code path to ensure no precision loss occurs during collateral-to-debt comparisons. Deploy a patched smart contract to a new address and migrate user positions through an automated migration contract or governance-approved transition plan. Reference the Marginal protocol documentation at https://marginal.gitbook.io/docs and repository at https://github.com/MarginalProtocol for upgrade procedures. NIST NVD details are available at https://nvd.nist.gov/vuln/detail/CVE-2026-4931. Users should await an official Marginal security advisory and patched contract deployment before resuming new position openings on affected instances.
Same weakness CWE-681 – Incorrect Conversion between Numeric Types
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today