Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/tharsis/evmos

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.4GoPublished

    Account compromise in Evmos

    CVE-2022-24738 · GHSA-5jgq-x857-p8xw

    Affected
    • Go github.com/tharsis/evmos < 2.0.1
    Fixed in
    2.0.1· Vendor fix available
    Issue
    Impact What kind of vulnerability is it? Who is impacted? Classification The vulnerability has been classified as critical with a score of 9.0 (highest). It has the potential to affect and drain unclaimed airdrop funds from Cosmos and Osmosis eligible user addresses. Disclosure The attack requires advanced knowledge of the internals of the core and application packages of IBC, IBC relayers, the Cosmos SDK AnteHandler, and the Evmos x/claims module. The step-by-step attack is described below: 1. An actor creates a malicious chain with a custom AnteHandler that skips signature verification for transactions, specifically IBC MsgTransfer. This allows the attacker to impersonate any account by setting a custom sender address field of the IBC transfer message. 2. The malicious actor then connects this newly created chain via IBC to Evmos and fills the recipient address from the transfer message with an address they control. 3. Once the IBC packet containing the Transfer data is relayed to…

    Recommended action: Upgrade to 2.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →