CVE-2025-54427: Polkadot Frontier DOS Vulnerability

CVE-2025-54427 Overview

CVE-2025-54427 affects Polkadot Frontier, the Ethereum Virtual Machine (EVM) compatibility layer for Polkadot and Substrate. The note_min_gas_price_target inherent extrinsic lacked a check_inherent implementation prior to commit a754b3d. This allowed a block producer to set the TargetMinGasPrice value without validation from other nodes. Repeated abuse pushes the MinGasPrice toward its upper bound each block, progressively inflating gas costs. Users then face prohibitively expensive contract execution, producing a denial-of-service condition against the network.

Critical Impact
A malicious block producer can continuously raise the minimum gas price, rendering EVM contract execution economically unviable on affected Frontier-based chains.

Affected Products

Polkadot Frontier (Ethereum/EVM compatibility layer for Polkadot and Substrate)
frame/dynamic-fee pallet versions prior to commit a754b3d
Substrate-based chains integrating Frontier for EVM support

Discovery Timeline

2025-07-28 - CVE-2025-54427 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54427

Vulnerability Analysis

The flaw resides in the frame/dynamic-fee pallet of Polkadot Frontier. The extrinsic note_min_gas_price_target is an inherent, meaning only the current block author can submit it during block construction. Substrate expects each inherent to implement the ProvideInherent trait, including a check_inherent function that other validators use to independently verify the submitted value. Frontier did not implement check_inherent for this inherent, so peers accepted whatever TargetMinGasPrice the block producer proposed. The value flows into the on_initialize hook, where it updates MinGasPrice within bounds derived from the previous block. This categorizes as an incorrect calculation issue [CWE-682].

Root Cause

The frame/dynamic-fee/src/lib.rs module declared an empty InherentError enum and no verification logic. Without check_inherent, honest validators had no way to reject an out-of-range target. Each block's upper and lower bounds derive from the prior block's MinGasPrice, so setting the target to the upper bound ratchets the ceiling upward on every subsequent block.

Attack Vector

An attacker must control a block-producing validator. On each authored block, the attacker submits note_min_gas_price_target with the maximum allowed target. Because peers do not validate the inherent, the block is accepted. Over successive blocks, the compounding upper bound drives gas prices high enough that legitimate transactions and contract calls become uneconomical.

rust

 	#[pallet::storage]
 	pub type TargetMinGasPrice<T: Config> = StorageValue<_, U256>;
 
-	#[derive(Encode, Decode, RuntimeDebug)]
-	pub enum InherentError {}
+	#[derive(Encode, Decode, RuntimeDebug, PartialEq)]
+	pub enum InherentError {
+		/// The target gas price is too high compared to the current gas price.
+		TargetGasPriceTooHigh,
+		/// The target gas price is too low compared to the current gas price.
+		TargetGasPriceTooLow,
+		/// The target gas price is zero, which is not allowed.
+		TargetGasPriceZero,
+	}
 
 	impl IsFatalError for InherentError {
 		fn is_fatal_error(&self) -> bool {
-			match *self {}
+			// All inherent errors are fatal as they indicate invalid block data
+			true
 		}
 	}

Source: GitHub Commit a754b3d. The patch introduces explicit error variants and marks all inherent errors as fatal, so peers reject blocks containing an invalid TargetMinGasPrice.

Detection Methods for CVE-2025-54427

Indicators of Compromise

Sustained upward drift in MinGasPrice values across consecutive blocks without corresponding demand.
Blocks in which note_min_gas_price_target is repeatedly set to the current upper bound by the same validator set.
User reports of failed or unaffordable EVM transactions on a Frontier-based chain.

Detection Strategies

Monitor on-chain TargetMinGasPrice and MinGasPrice storage values and alert on abnormal growth rates over rolling block windows.
Correlate block author identities with anomalous gas price movements to identify offending validators.
Compare running node builds against commit a754b3d to confirm the check_inherent implementation is present.

Monitoring Recommendations

Instrument chain telemetry to publish per-block gas price deltas and expose them to dashboards for the operations team.
Log all note_min_gas_price_target inherent submissions with author identity for post-incident review.
Alert when MinGasPrice exceeds a governance-defined ceiling appropriate for the chain's economic model.

How to Mitigate CVE-2025-54427

Immediate Actions Required

Upgrade Polkadot Frontier to a build that includes commit a754b3d or later.
Rebuild and redeploy all validator nodes so peer verification of check_inherent is uniform across the network.
Review recent MinGasPrice history and, if manipulation is suspected, use runtime governance to reset the value to a sane baseline.

Patch Information

The fix is delivered in commit a754b3d of the polkadot-evm/frontier repository. It implements check_inherent for note_min_gas_price_target, adds the TargetGasPriceTooHigh, TargetGasPriceTooLow, and TargetGasPriceZero variants to InherentError, and treats all inherent errors as fatal. Full details are available in the GitHub Security Advisory GHSA-r6rj-gmqh-cv94 and the SRLabs Security Report.

Workarounds

Constrain the MinGasPriceBoundDivisor in the runtime configuration to limit per-block gas price movement until the patch is deployed.
Use on-chain governance to override MinGasPrice if it drifts to unusable values.
Coordinate with validator operators to reject blocks from authors observed manipulating the gas price target.

bash

# Update the Frontier dependency to include commit a754b3d in Cargo.toml
cargo update -p pallet-dynamic-fee
cargo build --release
# Verify the running binary corresponds to the patched commit
git -C ./frontier log --oneline | grep a754b3d