ETK-2026-745Zero's internal tracking ID, independent of the CVE number.
waiting for further signalsZero needs more public information before it can validate it.description
Affected TwoResourceLiquidityPool instances can expose LP-token minting when created with unrestricted public contribution and redemption authorization. An unprivileged attacker able to submit a transaction and use an attacker-controlled template can mint unbacked LP tokens and redeem them for assets from a funded pool. The issue requires a funded pool whose configured contribution/redemption rule also permits LP-token minting.
mitigation
Do not create or fund affected pools with unrestricted contribution/redemption rules, and treat existing pools configured this way as exposed. Update the template so LP-token mint and burn authority is restricted to the pool component, then migrate liquidity to pools created with the corrected authorization; no fixed package version is recorded.
outcome
Contextual: an exploit technique exists, but no deterministic check could cover this one.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-10-05 11:10Zghsa: trigger signal, started the run
this entry in the feed
GET /api/v1/feed/ETK-2026-745
{ "etk_id": "ETK-2026-745", "cve_id": null, "display_id": "ETK-2026-745", "ghsa_id": "GHSA-q7qg-fgqp-p96v", "euvd_id": null, "status": "published", "anchor_state": "awaiting_cve", "title": "Improper LP token mint authorization in tari_template_builtin", "summary": "Affected TwoResourceLiquidityPool instances can expose LP-token minting when created with unrestricted public contribution and redemption authorization. An unprivileged attacker able to submit a transaction and use an attacker-controlled template can mint unbacked LP tokens and redeem them for assets from a funded pool. The issue requires a funded pool whose configured contribution/redemption rule also permits LP-token minting.", "mitigation": "Do not create or fund affected pools with unrestricted contribution/redemption rules, and treat existing pools configured this way as exposed. Update the template so LP-token mint and burn authority is restricted to the pool component, then migrate liquidity to pools created with the corrected authorization; no fixed package version is recorded.", "vendor": "rust", "product": "rust:tari_template_builtin", "affected": [ { "affected_notes": [], "affected_ranges": [ "= 0.42.0" ], "ecosystem": "rust", "fixed_versions": [], "package_name": "tari_template_builtin", "purl": "pkg:cargo/tari_template_builtin" } ], "cwes": [ 284 ], "cvss_score": 8.7, "cvss_src": "cna_vendor", "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "epss_score": null, "epss_percentile": null, "epss_asof": null, "automation": "contextual", "check": false, "check_confidence_basis": null, "exploit": false, "pipeline_minutes": 7.1613889833333335, "t0_at": null, "signals": { "trigger_signal": { "at": "2026-10-05T11:10:32+00:00", "days": -16.322749208680555, "is_lower_bound": true, "measured_at": "2026-10-21T18:55:17.554922+00:00", "url": "https://github.com/tari-project/tari-ootle/security/advisories/GHSA-q7qg-fgqp-p96v" } } }
published 2026-10-06 08:25Z
last change 2026-10-21 18:49Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.