Evmos vulnerable to exploit of smart contract account and vesting

Summary

Evmos is a decentralized Ethereum Virtual Machine chain on the Cosmos Network. Prior to version 19.0.0, a user can create a vesting account with a 3rd party account (EOA or contract) as funder. Then, this user can create an authorization for the contract.CallerAddress, this is the authorization checked in the code. But the funds are taken from the funder address provided in the message. Consequently, the user can fund a vesting account with a 3rd party account without its permission. The funder address can be any address, so this vulnerability can be used to drain all the accounts in the chain. The issue has been patched in version 19.0.0.

Timeline

1. Jul 5, 2024, 6:49 PM UTCCVE published
2. Jul 7, 2024, 1:57 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Aug 2, 2024, 4:26 AM UTCRecord last updated

Affected versions

• evmos evmos

  fixed in 19.0.0

• github.com/evmos/evmosGo

  All versions

• github.com/evmos/evmos/v2Go

  All versions

• github.com/evmos/evmos/v3Go

  All versions

• github.com/evmos/evmos/v4Go

  All versions

• github.com/evmos/evmos/v5Go

  All versions

• github.com/evmos/evmos/v6Go

  All versions

• github.com/evmos/evmos/v7Go

  All versions

• github.com/evmos/evmos/v8Go

  All versions

• github.com/evmos/evmos/v9Go

  All versions

• github.com/evmos/evmos/v10Go

  All versions

• github.com/evmos/evmos/v11Go

  All versions

• github.com/evmos/evmos/v12Go

  All versions

• github.com/evmos/evmos/v13Go

  All versions

• github.com/evmos/evmos/v14Go

  All versions

• github.com/evmos/evmos/v15Go

  All versions

• github.com/evmos/evmos/v16Go

  All versions

• github.com/evmos/evmos/v17Go

  All versions

• github.com/evmos/evmos/v18Go

  All versions

• github.com/evmos/evmos/v19Go

  fixed in 19.0.0

• github.com/evmos/evmos/v18Go

  fixed in 19.0.0

References 2