An unauthorized spending policy check allows an attacker to bypass all limitations imposed on a parent SmartAccount when a transaction originates from a Pocket sub‑address. The flaw causes the StateEngine to default to an "authorized/no policy" result before determining the pocket’s parent, enabling any user, or any holder of a parent account key, to drain all of a pocket’s balance even when the parent account has strict daily limits or a vault delay. The vulnerability is rooted in improper authorization (CWE‑284) and privilege escalation (CWE‑639).

The affected product is UltraDAGcom:core, a minimal DAG‑BFT blockchain implementation written in Rust. The bug existed in versions running the StateEngine up to, but not including, commit fb6ef59d6c1385400e7acea7ae31fc6a473c3051. No other specific version strings are supplied, but any deployment containing the unpatched logic is vulnerable.

The CVSS score of 8.8 classifies this as a high‑severity flaw. The EPSS score is not available, and it is not listed in the CISA KEV catalog, yet the vulnerability can be exploited via any user’s ability to submit transactions from a Pocket address. The likely attack vector is the creation and broadcasting of a malicious SmartTransferTx transaction, which can instantly transfer all funds from the targeted pockets. Given the lack of a running EPSS value, the exploitation probability remains uncertain, but the functional nature of the flaw means that its impact would be devastating if leveraged.