UltraDAGcom core, a Rust-based minimal DAG-BFT blockchain, contained a critical logic flaw in its SmartTransferTx policy enforcement pipeline before commit fb6ef59. Specifically, when a transaction originates from a "Pocket"—a virtual sub-address without its own SmartAccountConfig—the system failed to resolve the parent account before enforcing spending policies. As a result, the check_spending_policy method defaulted to an "authorized/no policy" outcome, enabling any user or attacker with the parent account key to bypass vault delays and daily limits to drain all pockets under that account. This vulnerability is tracked as CVE-2026-42278 with a CVSS 4.0 score of 8.8 (high severity). The flaw has been addressed by the referenced commit.

An attacker possessing the parent account key can bypass critical spending policies such as 24-hour vault delays and daily transfer limits by exploiting the improper access control on pocket sub-addresses. This leads to immediate and unauthorized draining of all funds stored in pockets under the affected account. The vulnerability compromises the intended security controls of the UltraDAGcom core blockchain, potentially resulting in significant financial loss for users relying on these protections.

This vulnerability has been patched in UltraDAGcom core as of commit fb6ef59. Users and operators should update to versions including this commit or later to remediate the issue. Since no official remediation level or patch links are provided beyond the commit reference, it is recommended to consult the UltraDAGcom project repository or vendor advisory for the exact update instructions. There are no known exploits in the wild, but immediate patching is advised to prevent potential exploitation.