Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. In versions of evmos prior to 2.0.1 attackers are able to drain unclaimed funds from user addresses. To do this an attacker must create a new chain which does not enforce signature verification and connects it to the target evmos instance. The attacker can use this joined chain to transfer unclaimed funds. Users are advised to upgrade. There are no known workarounds for this issue.
References
Link | Resource |
---|---|
https://github.com/tharsis/evmos/commit/28870258d4ee9f1b8aeef5eba891681f89348f71 | Patch Third Party Advisory |
https://github.com/tharsis/evmos/releases/tag/v2.0.1 | Release Notes Third Party Advisory |
https://github.com/tharsis/evmos/security/advisories/GHSA-5jgq-x857-p8xw | Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: GitHub_M
Published: 2022-03-07T21:30:13
Updated: 2022-03-07T21:30:13
Reserved: 2022-02-10T00:00:00
Link: CVE-2022-24738
JSON object: View
NVD Information
Status : Analyzed
Published: 2022-03-07T22:15:08.227
Modified: 2023-05-16T22:53:49.397
Link: CVE-2022-24738
JSON object: View
Redhat Information
No data.
CWE