Yihuang

**Name of the Vulnerable Software and Affected Versions** Ethermint versions prior to v0.17.2 Ethermint versions prior to v0.18.0 are not affected if they are v0.17.2 or later, but since v0.17.2 is not a fixed version and only v0.18.0 is mentioned as fixed, we consider all versions before v0.18.0 as vulnerable. Cronos versions prior to v0.8.0 **Description** The issue arises when a contract invokes the `selfdestruct` function, which permanently removes the corresponding bytecode from the internal database storage. However, due to a bug in the `DeleteAccount` function, all contracts that used the identical bytecode will also stop working once one contract invokes `selfdestruct`. This can lead to a denial-of-service (DoS) for all contracts that share the same bytecode. No smart contracts were impacted through the use of this vulnerability due to successful coordinated security vulnerability disclosure. Smart contract states and storage values are not affected by this vulnerability. **Recommendations** For Ethermint versions prior to v0.17.2, upgrade to version v0.18.0 or later. For Cronos versions prior to v0.8.0, upgrade to version v0.8.0 or later. As a temporary workaround, if a contract is subject to DoS due to this issue, the user can redeploy the same contract with identical bytecode to recover the original contract's code.

Name of the Vulnerable Software and Affected Versions: Tendermint Core versions 0.34.0 through 0.34.2 Description: The issue arises from the mishandling of timestamps during the consensus process in Tendermint Core, which can cause a denial of service. When double signs are observed, the consensus reactor forms DuplicateVoteEvidence, but since the current block is still "in flight" and hasn't been finalized through network consensus, different nodes may observe different "last commits" and assign different timestamps to DuplicateVoteEvidence. This results in some DuplicateVoteEvidence being considered invalid, leading to nodes proposing invalid evidence and potentially being disconnected by their peers. The bug means that double signs are denial-of-service vectors in the affected versions. Recommendations: For Tendermint Core versions 0.34.0 through 0.34.2, update to version 0.34.3 to fix the bug. As of version 0.34.3, DuplicateVoteEvidence is no longer formed by the consensus reactor, but rather by the EvidencePool, which has consistent timestamp information across the network.