UltraDAGcom core version 0.1 contains a vulnerability classified as CWE-460 (Improper Cleanup on Thrown Exception) and CWE-696. An attacker without council privileges can submit a SmartOp::Vote transaction that passes signature, nonce, and balance prechecks but fails authorization only after the system has already mutated state. This sequence allows unauthorized state changes despite the transaction ultimately being unauthorized. The CVSS 4.0 base score is 8.8, indicating high severity. No patch or official remediation level has been provided by the vendor, and the product is not a cloud service.

The vulnerability permits unauthorized state mutations in the blockchain core, potentially undermining the integrity of the voting mechanism by allowing non-council actors to affect state changes that should be restricted. This could lead to unauthorized influence over blockchain consensus or governance processes. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently available, users should monitor vendor communications for updates. No specific mitigation steps are provided by the vendor at this time.