PT-2024-27337 · Evmos · Evmos

Evmosdao + 1 · Published 2024-06-06 · Updated 2024-10-15 · CVE-2024-37153

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Evmos versions prior to V18.1.0

Description The issue is related to liquid staking using Safe, which is a contract. The bug appears when there is a local state change together with an ICS20 transfer in the same function, and it uses the contract's balance. This is essentially the "infinite money glitch" allowing contracts to double the supply of Evmos after each transaction.

Recommendations For versions prior to V18.1.0, update to a version >=V18.1.0 to patch the issue. As a temporary workaround, consider restricting the use of the contract's balance in ICS20 transfers to minimize the risk of exploitation. Avoid using the sender parameter with the contract address in ICS20 transfers using the ICS20 precompile until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-670

Related Identifiers

CVE-2024-37153

GHSA-XGR7-JGQ3-MHMC

GO-2024-2903

Affected Products

Evmos

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37153.json · Exploit
• 🔥 https://github.com/evmos/evmos/security/advisories/GHSA-xgr7-jgq3-mhmc · Exploit
• https://github.com/evmos/evmos/commit/478b7a62e7af57a70cf3a01126c7f5a89bee69d7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-37153 · Security Note
• https://osv.dev/vulnerability/GO-2024-2903 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xgr7-jgq3-mhmc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-37153 · Vendor Advisory
• https://github.com/evmos/evmos · Note
• https://t.me/cvenotify/98187 · Telegram Post
• https://twitter.com/CVEnew/status/1798795454467199333 · Twitter Post
• https://pkg.go.dev/vuln/GO-2024-2903 · Note