// For flags

CVE-2024-37153

Evmos's contract balance not updating correctly after interchain transaction

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. There is an issue with how to liquid stake using Safe which itself is a contract. The bug only appears when there is a local state change together with an ICS20 transfer in the same function and uses the contract's balance, that is using the contract address as the sender parameter in an ICS20 transfer using the ICS20 precompile. This is in essence the "infinite money glitch" allowing contracts to double the supply of Evmos after each transaction.The issue has been patched in versions >=V18.1.0.

Evmos es el centro de máquinas virtuales Ethereum (EVM) en Cosmos Network. Existe un problema con la forma de realizar apuestas líquidas utilizando Safe, que en sí mismo es un contrato. El error solo aparece cuando hay un cambio de estado local junto con una transferencia ICS20 en la misma función y usa el saldo del contrato, es decir, usa la dirección del contrato como parámetro del remitente en una transferencia ICS20 usando la precompilación ICS20. Este es, en esencia, el "fallo del dinero infinito" que permite a los contratos duplicar el suministro de Evmos después de cada transacción. El problema se ha solucionado en las versiones >=V18.1.0.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
Poc
Automatable
Yes
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-06-03 CVE Reserved
  • 2024-06-06 CVE Published
  • 2024-08-02 CVE Updated
  • 2024-10-16 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-670: Always-Incorrect Control Flow Implementation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Evmos
Search vendor "Evmos"
Evmos
Search vendor "Evmos" for product "Evmos"
<= 18.0.0
Search vendor "Evmos" for product "Evmos" and version " <= 18.0.0"
en
Affected