Fedekunze

**Name of the Vulnerable Software and Affected Versions** Cosmos Network Ethermint versions <= v0.4.0 **Description** The issue is related to a cross-chain transaction replay vulnerability in the EVM module. This vulnerability is caused by the use of the same chainID and signature schemes with Ethereum for compatibility, allowing a verified signature in Ethereum to be valid in Ethermint with the same message content and chainID. This enables a "cross-chain transaction replay" attack. The vulnerability affects the github.com/cosmos/ethermint/rpc/namespaces/eth package. **Recommendations** For Cosmos Network Ethermint versions <= v0.4.0, consider disabling the EVM module until a patch is available to prevent cross-chain transaction replay attacks. Restrict access to the github.com/cosmos/ethermint/rpc/namespaces/eth package to minimize the risk of exploitation. Avoid using the same chainID and signature schemes with Ethereum until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.