Manticore discovers the ENS bug

Summary: The Ethereum Name Service contract carried a critical bug, tracked as CVE-2020-5232, that let a person who transferred a name in a specific way later claim it back from the new owner; normal transfers were not affected. Trail of Bits ran its Manticore symbolic execution tool against the original contract's EVM bytecode and found two exploit paths in a few minutes, both requiring the attacker to send a setTTL or setResolver transaction before selling the name.
Key Takeaway: The bug only worked if the seller set themselves up from the start to reclaim the name, so the exploit was built into the transfer flow rather than forced from outside. ENS migrated to a new contract whose API changed enough that these exploits no longer apply, but the source notes contract owners should build tests for important security properties into their development process.

Read the original at Trail of Bits Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2020-5232
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026