Hydra: Missing Head state-token check in deposit Claim
Summary
Hydra, a layer-two scaling solution for Cardano, does not fully validate the Claim branch of its deposit validator. A party that can build a Cardano transaction can spend a pending deposit UTxO before its deadline and redirect the assets to an arbitrary address. The attack applies to deposits made via POST /commit that are confirmed but not yet claimed; the default deadline is three times depositPeriod.
Affected
- Hydra (cardano-scaling) versions before 2.1.0
Fixed in
- Hydra 2.1.0 (per the CVE description and vendor advisory GHSA-gfpc-m687-p7h5)
- Later releases add further deposit validator checks; deploy the newest release available
Workaround
Unknown. No vendor-documented workaround found; upgrading is the remedy.
Exploitation
- No known exploitation in the wild.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- Public PoC: unknown.
Our recommendation
- Check whether you run Hydra heads or nodes; if not, no action needed.
- Upgrade every Hydra node to the newest release, not only 2.1.0.
- Review pending deposits and their deadlines, and verify with your Hydra vendor or integrator.
- Restrict who can submit deposits until the upgrade is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Hydra commit ff60e4a (fix) github.com
- Hydra release 2.1.0 github.com
- GitHub Security Advisory GHSA-gfpc-m687-p7h5 github.com
- Hydra security page github.com
- Hydra CHANGELOG github.com
- Hydra releases github.com
- CVE-2026-62162 record summary cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:31.
Original description (NVD)
Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the `Claim` branch in `hydra-plutus/validators/deposit.ak` checks only that `datum.head_id` matches the attacker-controlled `redeemer.currencySymbol` and that the transaction is valid before the deposit deadline. It neither requires spending the Head state-token UTxO in the same transaction nor constrains outputs. After a deposit made through `POST /commit` is confirmed, any third party able to build a Cardano transaction can observe and consume the pending deposit UTxO before its deadline and redirect the assets to an arbitrary address. A standalone deposit spend invokes no Head validator, bypassing its safety checks; historical head-ID binding and the Aiken rewrite retained this missing invariant. The default deadline is three times depositPeriod, so the described attack applies to pending deposits before that deadline. This issue is fixed in version 2.1.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.