Listen to this Post
How the CVE Works
The vulnerability stems from insecure account deployment functions in Alchemy’s Non-SMA (Semi-Modular Account) and WebAuthn account factories. Versions 4.42.0 to 4.51.0 improperly handle wallet creation, exposing potential attack vectors during initialization. The flaw allows malicious actors to manipulate factory deployments, leading to unauthorized account access or contract hijacking. The patched version enforces strict validation in `createSemiModularAccount` and `createWebAuthnAccount` functions, ensuring secure wallet generation.
DailyCVE Form
Platform: Alchemy
Version: 4.42.0 – 4.51.0
Vulnerability: Insecure Account Deployment
Severity: High
Date: Jul 21, 2025
Prediction: Patch expected by Jul 25, 2025
What Undercode Say
Check affected versions
npm list @alchemyplatform/modular-account
Verify patch
git diff v4.51.0 v4.52.0 -- factory/AccountFactory.sol
Exploit PoC (simulated)
curl -X POST /deploy -d '{"factory":"vulnerable"}'
How Exploit
- Manipulate factory contract to deploy malicious wallets.
- Bypass initialization checks in legacy deployment functions.
- Hijack account creation flow via unvalidated inputs.
Protection from this CVE
- Upgrade to v4.52.0 immediately.
- Use `createSemiModularAccount` or
createWebAuthnAccount. - Audit all factory-deployed contracts.
Impact
- Unauthorized wallet access.
- Contract manipulation risks.
- Network-wide exploit potential.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
