Evmos up to 18.0.x sender control flow

Summaryinfo

A vulnerability labeled as problematic has been found in Evmos up to 18.0.x. The impacted element is an unknown function. Executing a manipulation of the argument sender can lead to control flow. This vulnerability is registered as CVE-2024-37153. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Evmos up to 18.0.x and classified as problematic. This vulnerability affects an unknown part. The manipulation of the argument sender with an unknown input leads to a control flow vulnerability. The CWE definition for the vulnerability is CWE-670. The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated. As an impact it is known to affect integrity. CVE summarizes:

Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. There is an issue with how to liquid stake using Safe which itself is a contract. The bug only appears when there is a local state change together with an ICS20 transfer in the same function and uses the contract's balance, that is using the contract address as the sender parameter in an ICS20 transfer using the ICS20 precompile. This is in essence the "infinite money glitch" allowing contracts to double the supply of Evmos after each transaction.The issue has been patched in versions >=V18.1.0.

The advisory is shared for download at github.com. This vulnerability was named CVE-2024-37153 since 06/03/2024. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

Upgrading to version 18.1.0 eliminates this vulnerability. Applying the patch 478b7a62e7af57a70cf3a01126c7f5a89bee69d7 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Evmos

Version

• 18.0

License

• open-source

Website

• Product: https://github.com/evmos/evmos/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion