CVE-2026-106511: Critical severity MultiversX multisig-improved vulnerability
MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. This vulnerability allows the Proposer role to move funds alone, draining 100% of a contract's EGLD/ESDT balance in two transactions with zero signatures.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any account that has the Proposer role on an affected multisig contract can exploit it. The issue does not require signatures from the other multisig participants.
What is the potential impact?
A Proposer can perform actions that should be barred for that role and move funds unilaterally. An attacker can drain 100% of the contract's EGLD and ESDT balances in two transactions.
How can I determine whether a multisig is at risk?
Review deployments using the multisig-improved reference implementation from the mx-multisig-and-modules repository and identify accounts assigned the Proposer role. Contracts holding EGLD or ESDT are exposed if a Proposer can submit the affected actions without independent authorization checks.