High severity · published Jul 5, 2024
CVE-2024-39696
Evmos vulnerable to exploit of smart contract account and vesting
8.1
CVSS
0.5%
EPSS
No
On KEV
Description
Evmos is a decentralized Ethereum Virtual Machine chain on the Cosmos Network. Prior to version 19.0.0, a user can create a vesting account with a 3rd party account (EOA or contract) as funder. Then, this user can create an authorization for the contract.CallerAddress, this is the authorization checked in the code. But the funds are taken from the funder address provided in the message. Consequently, the user can fund a vesting account with a 3rd party account without its permission. The funder address can be any address, so this vulnerability can be used to drain all the accounts in the chain. The issue has been patched in version 19.0.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EV
evmos · evmos
< 19.0.0 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-39696
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-39696
Patch
https://github.com/evmos/evmos/commit/0a620e176617a835ac697eea494afea09185dfaf
Vendor Advisory
https://github.com/evmos/evmos/security/advisories/GHSA-q6hg-6m9x-5g9c
More from evmos
9.1
CVE-2024-32644
Evmos' transaction execution not accounting for all state transition after interaction with precompiles
8.1
CVE-2024-37158
Evmos is missing precompile checks
7.5
CVE-2024-37153
Evmos's contract balance not updating correctly after interchain transaction
7.4
CVE-2022-24738
Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network
6.5
CVE-2024-37159
Evmos is missing create validator check