CVE-2024-32644

2024-04-1915:15:50

CWE-662

GitHub_M

web.nvd.nist.gov

evmos

proof-of-stake

ethereum

arbitrary tokens

synchronized states

cosmos sdk

vulnerability

fund drain

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

AI Score

6.7

Confidence

High

EPSS

Percentile

15.5%

JSON

Evmos is a scalable, high-throughput Proof-of-Stake EVM blockchain that is fully compatible and interoperable with Ethereum. Prior to 17.0.0, there is a way to mint arbitrary tokens due to the possibility to have two different states not in sync during the execution of a transaction. The exploit is based on the fact that to sync the Cosmos SDK state and the EVM one, we rely on the stateDB.Commit() method. When we call this method, we iterate though all the dirtyStorage and, if and only if it is different than the originStorage, we set the new state. Setting the new state means we update the Cosmos SDK KVStore. If a contract storage state that is the same before and after a transaction, but is changed during the transaction and can call an external contract after the change, it can be exploited to make the transaction similar to non-atomic. The vulnerability iscritical since this could lead to drain of funds through creative SC interactions. The issue has been patched in versions >=V17.0.0.

Affected configurations

Vulners

Vulnrichment

Node

evmosevmosRange<17.0.0

VendorProductVersionCPE
evmosevmos*cpe:2.3:a:evmos:evmos:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
evmos	evmos	*	cpe:2.3:a:evmos:evmos::::::::

CNA Affected

[
  {
    "vendor": "evmos",
    "product": "evmos",
    "versions": [
      {
        "version": "< 17.0.0",
        "status": "affected"
      }
    ]
  }
]