853 matches found
CVE-2024-37158
CVE-2024-37158 concerns Evmos, the EVM hub on Cosmos. The vulnerability stems from inconsistent ante handlers: clawback vesting actions could bypass Cosmos checks by sending an Ethereum transaction targeting a precompile used to interact with a Cosmos SDK module. The Evmos core implements two ant...
CVE-2024-37158 Evmos is missing precompile checks
Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. Preliminary checks on actions computed by the clawback vesting accounts are performed in the ante handler. Evmos core, implements two different ante handlers: one for Cosmos transactions and one for Ethereum transactions. Checks...
CVE-2024-37158: Insufficient Control Flow Management
Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. Preliminary checks on actions computed by the clawback vesting accounts are performed in the ante handler. Evmos core, implements two different ante handlers: one for Cosmos transactions and one for Ethereum transactions. Checks...
CVE-2024-37154
Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. Users are able to delegate tokens that have not yet been vested. This affects employees and grantees who have funds managed via ClawbackVestingAccount. This affects 18.1.0 and earlier...
CVE-2024-32873
Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. The spendable balance is not updated properly when delegating vested tokens. The issue allows a clawback vesting account to anticipate the release of unvested tokens. This vulnerability is fixed in 18.0.0...
GHSA-7HRH-V6WP-53VW Evmos allows unvested token delegations
Impact What kind of vulnerability is it? Who is impacted? At the moment, users are able to delegate tokens that have not yet been vested. This affects employees and grantees who have funds managed via ClawbackVestingAccount. Patches Has the problem been patched? What versions should users upgrade...
Evmos allows unvested token delegations
Impact What kind of vulnerability is it? Who is impacted? At the moment, users are able to delegate tokens that have not yet been vested. This affects employees and grantees who have funds managed via ClawbackVestingAccount. Patches Has the problem been patched? What versions should users upgrade...
CVE-2024-37154 Evmos allows unvested token delegations
Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. Users are able to delegate tokens that have not yet been vested. This affects employees and grantees who have funds managed via ClawbackVestingAccount. This affects 18.1.0 and earlier...
CVE-2024-37154 Evmos allows unvested token delegations
Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. Users are able to delegate tokens that have not yet been vested. This affects employees and grantees who have funds managed via ClawbackVestingAccount. This affects 18.1.0 and earlier...
CVE-2024-37154
Summary: CVE-2024-37154 affects Evmos and allows delegating tokens that have not yet vested via the ClawbackVestingAccount mechanism, impacting users (employees/grantees) and is noted for 18.1.0 and earlier. The connected advisories describe an improper authorization/ delegation check gap and ind...
CVE-2024-37153
The CVE-2024-37153 issue affects Evmos (EVM hub on Cosmos). A vulnerability occurs when a local state change happens together with an ICS20 transfer within the same function, using the contract’s address as the sender in an ICS20 precompile transfer. This enables an effective “infinite money glit...
CVE-2024-37153 Evmos's contract balance not updating correctly after interchain transaction
Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. There is an issue with how to liquid stake using Safe which itself is a contract. The bug only appears when there is a local state change together with an ICS20 transfer in the same function and uses the contract's balance, that...
CVE-2024-37153 Evmos's contract balance not updating correctly after interchain transaction
Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. There is an issue with how to liquid stake using Safe which itself is a contract. The bug only appears when there is a local state change together with an ICS20 transfer in the same function and uses the contract's balance, that...
CVE-2024-32873 evmos allows transferring unvested tokens after delegations
Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. The spendable balance is not updated properly when delegating vested tokens. The issue allows a clawback vesting account to anticipate the release of unvested tokens. This vulnerability is fixed in 18.0.0...
CVE-2024-32873
CVE-2024-32873 affects Evmos (EVM Hub on Cosmos). The issue: spendable balance is not updated during delegation from clawback vesting accounts, enabling anticipation of unvested tokens release. Root cause involves vesting/delegation logic and vesting/account handling; multiple connected reports d...
CVE-2024-32873 evmos allows transferring unvested tokens after delegations
Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. The spendable balance is not updated properly when delegating vested tokens. The issue allows a clawback vesting account to anticipate the release of unvested tokens. This vulnerability is fixed in 18.0.0...
CVE-2024-32873: Incorrect Calculation
Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. The spendable balance is not updated properly when delegating vested tokens. The issue allows a clawback vesting account to anticipate the release of unvested tokens. This vulnerability is fixed in 18.0.0...
github.com/cosmos/ibc-go affected by IBC protocol "Huckleberry" vulnerability
The ibc-go module is affected by the Inter-Blockchain Communication IBC protocol "Huckleberry" vulnerability...