Medium severity · published Jun 6, 2024
CVE-2024-32873
evmos allows transferring unvested tokens after delegations
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. The spendable balance is not updated properly when delegating vested tokens. The issue allows a clawback vesting account to anticipate the release of unvested tokens. This vulnerability is fixed in 18.0.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EV
evmos · evmos
< 18.0.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-32873
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-32873
Patch
https://github.com/evmos/evmos/commit/b2a09ca66613d8b04decd3f2dcba8e1e77709dcb
Vendor Advisory
https://github.com/evmos/evmos/security/advisories/GHSA-pxv8-qhrh-jc7v
More from evmos
9.1
CVE-2024-32644
Evmos' transaction execution not accounting for all state transition after interaction with precompiles
8.1
CVE-2024-39696
Evmos vulnerable to exploit of smart contract account and vesting
8.1
CVE-2024-37158
Evmos is missing precompile checks
7.5
CVE-2024-37153
Evmos's contract balance not updating correctly after interchain transaction
7.4
CVE-2022-24738
Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network