Description
Smart contract Marginal v1 performs unsafe downcast, allowing attackers to settle a large debt position for a negligible asset cost.
Affected products
marginal: v1-core
References5
- cvefeed.io/cwe/detail/cwe-681-incorrect-conversion-between-nume… Not Applicable
- github.com/MarginalProtocol Product
- marginal.gitbook.io/docs Product
- medium.com/@clarkcorrin/cve-2026-4931-how-spearbits-cantina-den… MitigationPress/Media CoverageThird Party Advisory
- scs.owasp.org/SCWE/SCSVS-CODE/SCWE-041/ Not Applicable
Metrics
- CVSS 3.1
-
8.6
HIGH
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N - EPSS — exploit probability
- 0% percentile: 19 · as of 12 November 2026
- CWE
- CWE-681
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.