CVE-2023-38698

CVE-2023-38698 is an integer overflow vulnerability in the Ethereum Name Service (ENS) @ensdomains/ens-contracts prior to version 0.0.22, allowing an attacker-controlled controller to reduce the expiration time of existing ENS domains. This medium-severity vulnerability (CVSS 6.5) could enable attackers to force domain expiration and claim them, with a low attack complexity and no user interaction required. While it currently requires a malicious DAO to exploit, future changes to ENS renewal policies or controller vulnerabilities could broaden its exploitability. There is no evidence of active exploitation, public exploit code, or significant community discussion.