---
title: "GHSA-2gw2-qgjg-xh6p: Namada-apps allows Post-Genesis Validator Bypass"
url: https://erroneo.us/security/ghsa/GHSA-2gw2-qgjg-xh6p/
description: "GHSA-2gw2-qgjg-xh6p (critical, crates.io (Rust)): Namada-apps allows Post-Genesis Validator Bypass. Impact Ledger crash. A user is able to initialize a…"
type: advisory
section: "Security Digest"
date_published: 2025-02-20
date_modified: 2025-02-20
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-2gw2-qgjg-xh6p"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-2gw2-qgjg-xh6p: Namada-apps allows Post-Genesis Validator Bypass

## Affected packages

- crates.io (Rust) `namada-apps` = 1.0.0 → fixed: 1.1.0

## Details

Impact Ledger crash. A user is able to initialize a post-genesis validator with a negative commission rate using the --force flag. If this validator gets into the consensus set, then when computing PoS inflation inside fn updaterewardsproductsandmintinflation, an instance of mulfloor will cause the return of an Err, which causes finalizeblock to error. Patches This issue has been patched in apps version 1.1.0. The PoS validity predicate now enforces that the commission rate is not negative and any transaction that fails the check will be rejected, both for newly initialized validators and for commission rate change of an existing validator. Workarounds There are no workarounds and users are advised to upgrade.

## Sources

- [GitHub Advisory GHSA-2gw2-qgjg-xh6p](https://github.com/advisories/GHSA-2gw2-qgjg-xh6p)
- [github.com](https://github.com/anoma/namada/security/advisories/GHSA-2gw2-qgjg-xh6p)

---
Source page: https://erroneo.us/security/ghsa/GHSA-2gw2-qgjg-xh6p/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt