evmos allows transferring unvested tokens after delegations

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

3.5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

EPSS

• CVE-2024-32873: 0.38% estimated exploitation activity in the next 30 days; percentile 32.56 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Impact This advisory has been created to address the following vulnerabilities found in the Evmos codebase and affecting vesting accounts. Wrong spendable balance computation The spendable balance is not updated properly when delegating vested tokens. The following example help in describing the issue: - Given a clawback vesting account with a starting 15M vesting schedule. The initial spendable balance is 0. - Time passes and 5M are vested. The spendable balance is now 5M. - The account delegate 5M. The spendable balance should be 0, but returns 5M - The account can send 5M to another account. The issue allowed a clawback vesting account to anticipate the release of unvested tokens. Missing precompile checks Preliminary checks on actions computed by the clawback vesting accounts are performed in the ante handler. Evmos core, implements two different ante handlers: one for Cosmos transactions and one for Ethereum transactions. Checks performed on the two implementation are different.…

Published by the source

6 Jun 2024, 18:21 UTC

Last modified by the source

12 Aug 2024, 16:03 UTC

Source last checked

26 Oct 2026, 15:04 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-pxv8-qhrh-jc7v

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2024-32873

Advisory: evmos allows transferring unvested tokens after delegations
IDs: CVE-2024-32873, GHSA-pxv8-qhrh-jc7v
Record: https://patchnext.com/advisories/cve-2024-32873 (revision 1, source checked 26 Oct 2026, 15:04 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Low (CVSS 3.5)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: github.com/evmos/evmos/v10 18.0.0; github.com/evmos/evmos/v15 18.0.0; github.com/evmos/evmos/v6 18.0.0; github.com/evmos/evmos/v7 18.0.0; github.com/evmos/evmos/v16 18.0.0; github.com/evmos/evmos/v13 18.0.0; github.com/evmos/evmos/v14 18.0.0; github.com/evmos/evmos/v17 18.0.0; github.com/evmos/evmos/v8 18.0.0; github.com/evmos/evmos/v12 18.0.0; github.com/evmos/evmos/v9 18.0.0; github.com/evmos/evmos/v11 18.0.0. A vendor fix does not mean a deployment is fixed.

## Affected components
- Go github.com/evmos/evmos/v10: affected <= 10.0.1; fixed in 18.0.0
- Go github.com/evmos/evmos/v15: affected <= 15.0.0; fixed in 18.0.0
- Go github.com/evmos/evmos/v6: affected <= 6.0.4; fixed in 18.0.0
- Go github.com/evmos/evmos/v7: affected <= 7.0.0; fixed in 18.0.0
- Go github.com/evmos/evmos/v16: affected <= 16.0.4; fixed in 18.0.0
- Go github.com/evmos/evmos/v13: affected <= 13.0.2; fixed in 18.0.0
- Go github.com/evmos/evmos/v14: affected <= 14.1.0; fixed in 18.0.0
- Go github.com/evmos/evmos/v17: affected <= 17.0.1; fixed in 18.0.0
- Go github.com/evmos/evmos/v8: affected <= 8.2.3; fixed in 18.0.0
- Go github.com/evmos/evmos/v12: affected <= 12.1.6; fixed in 18.0.0
- Go github.com/evmos/evmos/v9: affected <= 9.1.0; fixed in 18.0.0
- Go github.com/evmos/evmos/v11: affected <= 11.0.2; fixed in 18.0.0

## Suggested inspection (read-only)
- Go github.com/evmos/evmos/v10: check the installed version with your package manager.
- Go github.com/evmos/evmos/v15: check the installed version with your package manager.
- Go github.com/evmos/evmos/v6: check the installed version with your package manager.
- Go github.com/evmos/evmos/v7: check the installed version with your package manager.
- Go github.com/evmos/evmos/v16: check the installed version with your package manager.
- Go github.com/evmos/evmos/v13: check the installed version with your package manager.
- Go github.com/evmos/evmos/v14: check the installed version with your package manager.
- Go github.com/evmos/evmos/v17: check the installed version with your package manager.
- Go github.com/evmos/evmos/v8: check the installed version with your package manager.
- Go github.com/evmos/evmos/v12: check the installed version with your package manager.
- Go github.com/evmos/evmos/v9: check the installed version with your package manager.
- Go github.com/evmos/evmos/v11: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on github.com/evmos/evmos/v10, github.com/evmos/evmos/v15, github.com/evmos/evmos/v6, github.com/evmos/evmos/v7, github.com/evmos/evmos/v16, github.com/evmos/evmos/v13, github.com/evmos/evmos/v14, github.com/evmos/evmos/v17, github.com/evmos/evmos/v8, github.com/evmos/evmos/v12, github.com/evmos/evmos/v9, github.com/evmos/evmos/v11.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-pxv8-qhrh-jc7v (GitHub-reviewed advisory GHSA-pxv8-qhrh-jc7v lists affected ranges: Go github.com/evmos/evmos/v17 >=0 =0 =0 =0 =0 =0 =0 =0 =0 =0…)

Commands are suggestions: review each one before running it.