Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. Details We discovered a bug walking through how to liquid stake using Safe which itself is a contract. The bug only appears when there is a local state change together with an ICS20 transfer in the same function and uses the contract's balance, that is using the contract address as the sender parameter in an ICS20 transfer using the ICS20 precompile Proof of Concept Impact This is in essence the "infinite money glitch" allowing contracts to double the supply of Evmos after each transaction. Severity Based on ImmuneFi Severity Classification System the severity was evaluated to Critical since the attack could have lead to create new supply of EVMOS and therefore lead to Direct loss of funds's value. Patches The issue has been patched in versions =V18.1.0. For more…
Recommended action: Upgrade to 18.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This advisory has been created to address the following vulnerabilities found in the Evmos codebase and affecting vesting accounts. Wrong spendable balance computation The spendable balance is not updated properly when delegating vested tokens. The following example help in describing the issue: - Given a clawback vesting account with a starting 15M vesting schedule. The initial spendable balance is 0. - Time passes and 5M are vested. The spendable balance is now 5M. - The account delegate 5M. The spendable balance should be 0, but returns 5M - The account can send 5M to another account. The issue allowed a clawback vesting account to anticipate the release of unvested tokens. Missing precompile checks Preliminary checks on actions computed by the clawback vesting accounts are performed in the ante handler. Evmos core, implements two different ante handlers: one for Cosmos transactions and one for Ethereum transactions. Checks performed on the two implementation are different.…
Recommended action: Upgrade to 18.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.