Executive brief
UltraDAG is a blockchain platform written in Rust. A logic flaw in its transaction processing engine allows users to bypass security constraints like daily spending limits and time-locked vaults by sending funds through "Pockets" (sub-addresses). This could allow an attacker who gains access to a restricted key to instantly drain all funds from these sub-addresses, ignoring the safety limits intended to protect the account.
Technical details
A logic flaw exists in the `check_spending_policy` method within `crates/ultradag-coin/src/state/engine.rs`. When processing a `SmartTransferTx` from a "Pocket" (a virtual derived sub-address), the engine fails to resolve the pocket's parent account. Because pockets do not have their own `SmartAccountConfig` entries in the state tree, the policy check defaults to an authorized state with no constraints. This bypasses all security features including daily limits, vault time-locks, and whitelists. An attacker with a key authorized only for limited spending can exploit this to drain the full balance of any pocket associated with the parent account. The issue was fixed by ensuring the engine resolves the `pocket_to_parent` mapping before loading policy configurations.
Affected products
- UltraDAGcom UltraDAG core Prior to commit fb6ef59
Timeline
- 2026-04-21: patched: Fixed in commit fb6ef59
- 2026-05-08: advisory: NVD and GitHub advisory published