Evmos is a scalable, high-throughput Proof-of-Stake EVM blockchain that is fully compatible and interoperable with Ethereum. Prior to 17.0.0, there is a way to mint arbitrary tokens due to the possibility to have two different states not in sync during the execution of a transaction. The exploit is based on the fact that to sync the Cosmos SDK state and the EVM one, we rely on the `stateDB.Commit()` method. When we call this method, we iterate though all the `dirtyStorage` and, **if and only if** it is different than the `originStorage`, we set the new state. Setting the new state means we update the Cosmos SDK KVStore. If a contract storage state that is the same before and after a transaction, but is changed during the transaction and can call an external contract after the change, it can be exploited to make the transaction similar to non-atomic. The vulnerability is **critical** since this could lead to drain of funds through creative SC interactions. The issue has been patched in versions >=V17.0.0.
References
Configurations
History
06 Mar 2025, 15:00
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/evmos/evmos/blob/b196a522ba4951890b40992e9f97aa610f8b5f9c/x/evm/statedb/statedb.go#L460-L465 - Product | |
| References | () https://github.com/evmos/evmos/security/advisories/GHSA-3fp5-2xwh-fxm6 - Vendor Advisory | |
| References | () https://github.com/evmos/evmos/commit/08982b5ee726b97bc50eaf58d1914829648b6a5f - Patch | |
| CWE | NVD-CWE-noinfo | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.1 |
| First Time |
Evmos
Evmos evmos |
|
| CPE | cpe:2.3:a:evmos:evmos:*:*:*:*:*:*:*:* |
19 Apr 2024, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-04-19 15:15
Updated : 2025-03-06 15:00
NVD link : CVE-2024-32644
Mitre link : CVE-2024-32644
JSON object : View
Products Affected
evmos
- evmos
CWE