Technical impact
PoseidonV1 (PoseidonSponge) is a cryptographic hash function used in Stellar Soroban smart contracts. The implementation accepts variable-length input vectors without explicit padding. When the number of supplied inputs is less than the sponge rate (inputs.len() < T‑1), the remaining rate positions are implicitly zero‑filled. Because the pre‑permutation state is identical for [m1,…,mk] and [m1,…,mk,0] when k < T‑1, the two input vectors hash to the same digest. This creates a trivial hash collision that undermines the integrity guarantees of any hash‑based check, allowing an attacker to generate distinct inputs that produce the same hash output. The weakness is classified as CWE‑328.
Affected Systems
The vulnerability affects the Stellar rs‑soroban‑poseidon library, specifically the PoseidonV1 (PoseidonSponge) implementation. Any smart contract or application that invokes poseidon_hash or PoseidonSponge with fewer inputs than the sponge rate (for example, hashing a single input when T equals 3) is vulnerable. The Poseidon2 (Poseidon2Sponge) implementation is not impacted. The issue was addressed in release v25.0.1, which removes the implicit zero‑padding behavior.
Risk and Exploitability
CVSS score 8.7 indicates a high severity vulnerability, and the EPSS score is less than 1 %, implying a low probability of active exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via a smart contract that controls the inputs to PoseidonSponge, such as a malicious transaction that calls the hash function with explicitly fewer inputs, thereby inducing a collision. While the flaw does not grant code execution, it can subvert integrity checks and potentially damage contract logic. Consequently, the risk is moderate to high, warranting prompt update of affected deployments.
Github GHSA