CVE-2018-25098 is a medium severity denial of service flaw, scored 4.3, in the executeUcacTx function of the Blockmason credit-protocol smart contract. The product is unsupported and has no versions. The fix is commit 082e01f, and live deployments should also consider staking more tokens.
What's affected
- Product: blockmason credit-protocol, the UCAC handler in contracts/CreditProtocol.sol.
- Affected: the record says the product does not use versioning, so no affected or unaffected releases are listed.
- Fixed: the patch is commit 082e01f18707ef995e80ebe97fcedb229a55efc5, merged through pull request 33.
- Status: the record is marked unsupported when assigned, and says it only affects products no longer supported by the maintainer.
- Severity: 4.3 Medium (AV:A/AC:L/PR:N/UI:N). Weakness tags are CWE-404 and CWE-672.
How to check if you're exposed
- Check whether you run, fork or depend on blockmason/credit-protocol. Look in your repositories for the file contracts/CreditProtocol.sol.
- Compare your copy of the contract with commit 082e01f in the project repository. If your code does not include that change, the defect is present.
- For a deployed contract, remember that bytecode on a chain cannot be edited in place. Ask whoever deployed it whether a patched version was released and whether you migrated to it.
- Review how much stake sits behind each UCAC you rely on, since the pull request ties the attack cost to staked tokens.
What to do now
- Identify any use of the contract in your estate, including forks and vendored copies.
- Apply the change from commit 082e01f if you maintain a fork, and redeploy through your normal contract release process.
- For a live contract you cannot replace, read the mitigation in the pull request: staking more tokens raises the transaction limit and the cost of keeping the attack going.
- Plan to move off an unsupported component. No further fixes are expected from the maintainer.
Why it matters
The pull request description says executeUcacTx is an inexpensive and unauthenticated function. It increases the transaction counter for a UCAC without performing a transaction, up to that UCAC's transaction limit. Someone who calls it continuously can use up the limit and block legitimate transactions. The text says the attack can be maintained once started.
The weakness tags are improper resource shutdown or release and an operation on a resource after expiration. The deeper lesson is about cost: a public function that changes shared state cheaply and without authentication is a lever for anyone. The record's KEV flag is false, and the sources do not report real world abuse.
Quick check
Why is this scored Medium if it can be kept up indefinitely?
The score of 4.3 reflects availability impact only, from an adjacent network position, with no confidentiality or integrity loss. It is a denial of service, not a theft.
Can I patch a deployed contract?
Not in place. You would deploy a fixed contract and move to it. The pull request lists staking as a mitigation for an already live contract.
Sources
- Pull request 33, Fix DoS vulnerability in Credit Protocol contract: Cause description and the stake based mitigation. The fix commit is 082e01f.
Last reviewed: 19 October 2026.
