A critical logic error in the Stellar rs-soroban-sdk allows unauthenticated attackers to bypass security checks by forcing contracts to execute unintended, insecure function variants.

The #[contractimpl] macro incorrectly routes function calls to inherent methods rather than trait-defined methods when naming collisions occur. This allows an unauthenticated actor to trigger functions that lack critical authorization logic, effectively bypassing security controls.

Successful exploitation of this vulnerability can lead to unauthorized execution of administrative or sensitive contract functions, resulting in the compromise of contract data and state integrity. With a CVSS score of 7.5, this high-severity flaw poses a significant risk to the financial security and operational reliability of applications utilizing the affected Soroban contracts.

Immediate Action: Update the soroban-sdk-macros dependency to versions 22.0.10, 23.5.2, or 25.1.1 immediately to resolve the macro routing logic.

Proactive Monitoring: Audit existing smart contract implementations for function name collisions between impl Trait and impl Type blocks to identify potentially vulnerable code paths.

Compensating Controls: While no direct WAF exists for smart contracts, perform rigorous post-patch code reviews and unit testing to ensure that sensitive functions are correctly invoked and protected by the intended authorization logic.

Public Exploit Available: Unknown

The severity of this issue necessitates an immediate audit of all Soroban-based projects. Developers must prioritize updating the soroban-sdk-macros package to the specified patched versions to ensure that function calls are correctly routed and security checks remain enforceable. Failure to remediate this vulnerability leaves contracts exposed to unauthorized access and potential manipulation of sensitive business logic.