8 results · Feed
-
High 8.8
Evmos vulnerable to exploit of smart contract account and vesting
Evmos is a decentralized Ethereum Virtual Machine chain on the Cosmos Network. Prior to version 19.0.0, a user can create a vesting account with a 3rd party account (EOA or contract) as funder. Then, this user can create an authorization for the contract.Call…
-
Medium 5.3
Evmos allows unvested token delegations
Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. Users are able to delegate tokens that have not yet been vested. This affects employees and grantees who have funds managed via `ClawbackVestingAccount`. This affects 18.1.0 and earlier.
-
High 7.5
Evmos's contract balance not updating correctly after interchain transaction
Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. There is an issue with how to liquid stake using Safe which itself is a contract. The bug only appears when there is a local state change together with an ICS20 transfer in the same functi…
-
Low 3.5
evmos allows transferring unvested tokens after delegations
Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. The spendable balance is not updated properly when delegating vested tokens. The issue allows a clawback vesting account to anticipate the release of unvested tokens. This vulnerability is…
-
Critical 9.1
Evmos' transaction execution not accounting for all state transition after interaction with precompiles
Evmos is a scalable, high-throughput Proof-of-Stake EVM blockchain that is fully compatible and interoperable with Ethereum. Prior to 17.0.0, there is a way to mint arbitrary tokens due to the possibility to have two different states not in sync during the ex…
-
Medium —
Evmos vulnerable to unauthorized account creation with vesting module
### Impact _What kind of vulnerability is it? Who is impacted?_ Using the vesting module, a malicious attacker can create a new vesting account at a given address, before a contract is created on that address. Addresses of smart contracts deployed to the EVM …
-
Critical 9.1
Evmos vulnerable to DOS and transaction fee expropiation through Authz exploit
## Impact _What kind of vulnerability is it? Who is impacted?_ An attacker can use this bug to bypass the block gas limit and gas payment completely to perform a full Denial-of-Service against the chain. ## Disclosure Evmos versions below `v11.0.1` do not che…
-
High 8.2
Ethermint DoS through Unintended Contract Selfdestruct
Ethermint is an Ethereum library. In Ethermint running versions before `v0.17.2`, the contract `selfdestruct` invocation permanently removes the corresponding bytecode from the internal database storage. However, due to a bug in the `DeleteAccount`function, a…