RUSTSEC-2022-0083: evm incorrect state transition

What to do

1. See which version you have: cargo tree -i evm (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p evm. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example evm = "0.36.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine.

A custom stateful precompile can use the is_static parameter to determine if the call is executed in a static context (via STATICCALL), and thus decide if stateful operations should be done.

Prior to version 0.36.0, the passed is_static parameter was incorrect -- it was only set to true if the call came from a direct STATICCALL opcode.

However, once a static call context is entered, it should stay static. The issue only impacts custom precompiles that actually uses is_static.

For those affected, the issue can lead to possible incorrect state transitions.

References

• Package: crates.io/crates/evm
• Advisory: rustsec.org/advisories/RUSTSEC-2022-0083.html
• Web: github.com/rust-blockchain/evm/pull/133

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for evm

• VulnerabilityGHSA-27wg-99g8-2v4v · 2024-01-03Rust EVM erroneousle handles `record_external_operation` error return
• VulnerabilityGHSA-4jwq-572w-4388 · 2024-01-30Memory over-allocation in evm crate
• VulnerabilityGHSA-4jwq-572w-4388 · 2024-01-30Memory over-allocation in evm crate
• VulnerabilityGHSA-4jwq-572w-4388 · 2024-01-30Memory over-allocation in evm crate
• VulnerabilityGHSA-4jwq-572w-4388 · 2024-01-30Memory over-allocation in evm crate
• VulnerabilityGHSA-4jwq-572w-4388 · 2024-01-30Memory over-allocation in evm crate
• VulnerabilityGHSA-4jwq-572w-4388 · 2024-01-30Memory over-allocation in evm crate
• VulnerabilityGHSA-pvh2-pj76-4m96 · 2021-10-19Specification non-compliance in JUMPI

Full security history of evm