CVE-2024-37153 in Evmos
Summary
by MITRE • 06/06/2024
Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. There is an issue with how to liquid stake using Safe which itself is a contract. The bug only appears when there is a local state change together with an ICS20 transfer in the same function and uses the contract's balance, that is using the contract address as the sender parameter in an ICS20 transfer using the ICS20 precompile. This is in essence the "infinite money glitch" allowing contracts to double the supply of Evmos after each transaction.The issue has been patched in versions >=V18.1.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2024
The vulnerability identified as CVE-2024-37153 affects Evmos, an Ethereum Virtual Machine hub operating within the Cosmos Network ecosystem. This critical flaw manifests in the liquid staking mechanism when utilizing Safe contracts, creating a scenario where malicious actors can exploit a specific combination of state changes and inter-chain transfers. The vulnerability specifically targets the interaction between local state modifications and ICS20 transfers executed within the same function, leveraging the contract address as the sender parameter in ICS20 precompile operations. This technical implementation flaw creates a fundamental disruption in the network's supply mechanism, enabling unauthorized duplication of Evmos tokens through carefully constructed transaction sequences. The issue represents a severe compromise to the network's economic integrity and security model.
The technical exploitation of this vulnerability occurs when a contract performs both a local state change and an ICS20 transfer within identical function calls, utilizing the contract's own balance and address as the sender parameter. This specific combination creates a condition where the system incorrectly calculates and records token balances, effectively allowing for infinite money generation. The mechanism relies on the precompile's handling of sender parameters within inter-chain transfer contexts, where the contract's own address is used as the source for token movement. This creates a state inconsistency where the same tokens can be claimed multiple times through successive transactions, fundamentally undermining the supply chain and economic stability of the Evmos network. The vulnerability operates at the intersection of EVM execution and Cosmos inter-chain communication protocols, making it particularly challenging to detect and prevent.
The operational impact of this vulnerability extends beyond simple financial loss, fundamentally compromising the trust and integrity of the Evmos network. The "infinite money glitch" allows for unlimited token duplication, potentially destabilizing the entire network's economic model and causing significant market disruption. The vulnerability affects all versions prior to V18.1.0, leaving extensive portions of the network exposed to potential exploitation. Attackers could manipulate token supplies to create artificial market conditions, potentially leading to significant financial losses for users and the network itself. The impact is particularly severe because it operates at the protocol level, affecting core network functions rather than individual applications or smart contracts. The vulnerability's nature means that any transaction involving the affected liquid staking mechanism could be exploited, creating a persistent threat to network security and user funds.
The patch implemented in version V18.1.0 addresses the root cause by modifying how state changes and ICS20 transfers are processed within the same function context. This update ensures proper handling of sender parameters in precompile operations and implements additional validation checks to prevent the specific combination that enables the exploit. The fix aligns with established security practices for preventing double-spending and supply manipulation attacks. Organizations should immediately upgrade to the patched version to eliminate exposure to this vulnerability. Security teams should also implement monitoring for any suspicious transaction patterns that might indicate attempted exploitation, particularly focusing on transactions involving the affected liquid staking mechanisms. The vulnerability demonstrates the importance of thorough testing for complex interactions between different protocol layers and highlights the need for comprehensive security reviews of inter-chain communication implementations. This case study serves as a reminder of the critical security considerations when implementing cross-chain functionality within blockchain networks, emphasizing the need for robust state management and parameter validation in smart contract systems.