WS-2023-0256

In PeriodicVestingAccount, defined in x/auth in Cosmos-SDK, an attacker can initialize a victim's account as a malicious vesting account, which allows deposits but does not allow withdrawals. When the user then deposits funds into their account, those funds are locked forever, and the user is not...