PT-2024-27343 · Evmos · Evmos

Published 2024-06-06 · Updated 2024-06-28 · CVE-2024-37159

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Evmos versions prior to 18.0.0

Description The issue concerns the Evmos codebase, specifically affecting vesting accounts. It involves three main problems: wrong spendable balance computation, missing precompile checks, and missing create validator check. The wrong spendable balance computation occurs when delegating vested tokens, allowing a clawback vesting account to anticipate the release of unvested tokens. The missing precompile checks enable a clawback account to bypass Cosmos ante handler checks by sending an Ethereum transaction targeting a precompile used to interact with a Cosmos SDK module. The missing create validator check allowed a user to create a validator using vested tokens to deposit the self-bond.

Recommendations For versions prior to 18.0.0, update to version 18.0.0 or later to fix the spendable balance function and implement the necessary checks for the staking module, delegation, and create validator. As a temporary workaround, consider restricting the use of vested tokens for delegations and creating validators until the update is applied. Avoid using the TrackDelegation function in the affected versions until the issue is resolved.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

CWE-682

Related Identifiers

CVE-2024-37159

GHSA-PXV8-QHRH-JC7V

GO-2024-2891

GO-2024-2926

GO-2024-2927

Affected Products

Evmos

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37159.json · Exploit
• https://github.com/evmos/evmos/commit/b2a09ca66613d8b04decd3f2dcba8e1e77709dcb · Patch
• https://github.com/evmos/evmos/security/advisories/GHSA-pxv8-qhrh-jc7v · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2927 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37159 · Security Note
• https://osv.dev/vulnerability/GO-2024-2926 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-37159 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37158 · Security Note
• https://osv.dev/vulnerability/GHSA-pxv8-qhrh-jc7v · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2891 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32873 · Security Note
• https://github.com/evmos/evmos · Note
• https://pkg.go.dev/vuln/GO-2024-2891 · Note