# Fixed: Cadence Vulnerabilities 2023-07-10

**URL:** <https://forum.flow.com/t/fixed-cadence-vulnerabilities-2023-07-10/5001>\
**Category:** Security Notifications\
**Created:** [July 14, 2023, 3:14pm UTC](https://forum.flow.com/t/fixed-cadence-vulnerabilities-2023-07-10/5001 "2023-07-14T15:14:58Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jan](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.flow.com/jan/32/672_2.png) [@Jan](https://forum.flow.com/u/Jan)\
**Post date:** [July 14, 2023, 3:14pm UTC](https://forum.flow.com/t/fixed-cadence-vulnerabilities-2023-07-10/5001/1 "2023-07-14T15:14:59Z")

</div>

# Cadence Security Report 2023-07-06

## Issue Overview

- Current Status: Issue Fixed
- Affected Network: Testnet, Mainnet

## Summary of Impact

Four issues were found with different impact levels:

1. A critical-impact vulnerability that would have allowed someone to duplicate resources.
2. A critical-impact vulnerability allowed crashing the execution node and thus halting the network.
3. A low-impact vulnerability that would lead to resources being lost.
4. An issue that rejected valid programs.

## Technical Summary of Issues

1. Taking a reference to an optional must return an optional reference. However, this was not the case for `AnyStruct`/ `AnyResource` optionals, allowing them to be misused. Thus, the following two cases are now rejected by the Cadence type checker:

- Taking a reference of an optional as a non-optional

- Taking a reference of a non-optional as an optional

1. During the transfer of resources, it was possible to get stuck in a recursive transfer, causing the execution node to be crashed/halted.
2. Functions with var-args allowed passing more arguments than the actual number of arguments that are expected by the function implementation, which could lead to a loss of resources. Passing such invalid additional arguments is now statically rejected.  
For example, the built-in `assert` function is accepting var-args, and any invalid use of this function may be impacted by this change. The [assert](https://developers.flow.com/cadence/language/built-in-functions#assert) function would only accept a maximum of two arguments: a `condition` and a `message`.
3. Inlined functions (function closures) could result in reporting errors for valid programs.

## Mitigation

The security reports were immediately acknowledged and reproduced. Fixes were developed and deployed to all networks. Improved the runtime defensive check to prevent misuse of references.

In the future, the Cadence team plans to add additional defensive checks to prevent resources from being duplicated or re-destroyed.

## Recognition

As core contributors to the Flow ecosystem, we take reported issues very seriously and would like to thank BlueSign for reporting the issues responsibly through our [Responsible Disclosure Policy 1](https://flow.com/flow-responsible-disclosure).

---

<div class="post-metadata">

**Author:** ![evans](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.flow.com/evans/32/1179_2.png) [@evans](https://forum.flow.com/u/evans)\
**Post date:** [July 18, 2023, 2:11pm UTC](https://forum.flow.com/t/fixed-cadence-vulnerabilities-2023-07-10/5001/2 "2023-07-18T14:11:35Z")

</div>

coool