ETK-2026-951Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-951",
  "cve_id": null,
  "display_id": "ETK-2026-951",
  "ghsa_id": "GHSA-7567-h34x-pgpx",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Initial-liquidity reserve capture in tari_template_builtin",
  "summary": "The TwoResourceLiquidityPool template in tari_template_builtin can assign ownership of pre-seeded reserves to the first account that contributes after an owner seeds a pool without receiving LP tokens. An untrusted contributor may then redeem LP for the seeded value when the pool has no outstanding LP and its contribution rule permits that caller.",
  "mitigation": "Do not pre-seed pools in separate transactions while no LP exists; create and bootstrap liquidity atomically with the intended owner, or restrict contribution access until bootstrap is complete. Review existing pre-seeded, LP-less pools and prevent untrusted contributions before funding them further.",
  "vendor": "rust",
  "product": "rust:tari_template_builtin",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 0.42.0"
      ],
      "ecosystem": "rust",
      "fixed_versions": [],
      "package_name": "tari_template_builtin",
      "purl": "pkg:cargo/tari_template_builtin"
    }
  ],
  "cwes": [
    682
  ],
  "cvss_score": 8.9,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 53.08026961666667,
  "t0_at": null,
  "signals": {
    "check": {
      "at": "2026-10-08T08:51:21.175653+00:00",
      "days": -13.536729595451389,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T21:44:14.637509+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-07T07:38:40+00:00",
      "days": -14.58720616550926,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T21:44:14.637509+00:00",
      "url": "https://github.com/tari-project/tari-ootle/security/advisories/GHSA-7567-h34x-pgpx"
    }
  }
}