CVE-2025-65951
BaseFortify
Publication date: 2025-11-25
Last updated on: 2025-11-25
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| entropy_derby | inside_track | 3.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
| CWE-327 | The product uses a broken or risky cryptographic algorithm or protocol. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Inside Track / Entropy Derby horse-racing betting engine's VDF-based timelock encryption system. Before a specific patch (commit 2d38d2f), the system failed to enforce a sequential delay for the betting operator. Bettors could pre-compute the entire Wesolowski Verifiable Delay Function (VDF) and include its output in their encrypted bet tickets. This allowed the house to decrypt bets immediately by using fast proof verification instead of performing the intended expensive VDF evaluation, bypassing the intended delay mechanism.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing the betting operator (the house) to decrypt bet tickets immediately rather than after the intended delay. This breaks the fairness and security model of the betting system, potentially enabling the operator to gain an unfair advantage by accessing bet information prematurely, which could affect betting outcomes and trust in the system.
What immediate steps should I take to mitigate this vulnerability?
Apply the patch that includes commit 2d38d2f, which fixes the VDF-based timelock encryption system to properly enforce sequential delay and prevent bettors from pre-computing the Wesolowski VDF output. This patch addresses the vulnerability by ensuring the house cannot decrypt bets immediately using fast proof verification.