CVE-2026-4931 Details
Description
Smart contract Marginal v1 performs unsafe downcast, allowing attackers to settle a large debt position for a negligible asset cost.
A vulnerability exists in the Marginal v1 smart contract due to unsafe downcasting of numeric types, specifically in the 'adjust()' function of the 'MarginalV1Pool' contract. This flaw allows attackers to settle large debt positions for a minimal asset cost by exploiting integer truncation. The issue arises because the contract improperly casts calculated margin values into a 'uint128' format without checking for overflow, leading to a significant loss of precision. As a result, an attacker can manipulate the system to drain protocol liquidity using a flash loan, all without requiring special access or user interaction.
The vulnerability has been patched by updating the smart contract to use OpenZeppelin's SafeCast library, which ensures safe conversions between numeric types. The patched implementation is now deployed on the Ethereum Mainnet.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cvefeed.io/cwe/detail/cwe-681-incorrect-conversion-between-numeric-types | [email protected] | Not Applicable |
| https://github.com/MarginalProtocol | [email protected] | Product |
| https://marginal.gitbook.io/docs | [email protected] | Product |
| https://medium.com/@clarkcorrin/cve-2026-4931-how-spearbits-cantina-denied-a-critical-vulnerability-using-verifiably-false-0a27b92ac2db | [email protected] | MitigationPress/Media CoverageThird Party Advisory |
| https://scs.owasp.org/SCWE/SCSVS-CODE/SCWE-041/ | [email protected] | Not Applicable |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-681 | Incorrect Conversion between Numeric Types | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| marginal v1-core | <= 1.0.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 22, 2026 | Initial Analysis | [email protected] |
| Apr 8, 2026 | CVE Modified | CISA-ADP |
| Apr 7, 2026 | New CVE Received | [email protected] |