Skip to content
OpenAdvisories
Low · 3.5 CVE-2024-32873 CVE-2024-37158CVE-2024-37159EUVD-2024-2129GHSA-pxv8-qhrh-jc7vGO-2024-2891GO-2024-2926GO-2024-2927

evmos allows transferring unvested tokens after delegations

Published Jun 6, 2024 · Updated Aug 2, 2024 · Assigned by GitHub_M

Vendor: evmos Product: evmos Package: github.com/evmos/evmos Package: github.com/evmos/evmos/v10 Package: github.com/evmos/evmos/v11 Package: github.com/evmos/evmos/v12 Package: github.com/evmos/evmos/v13 Package: github.com/evmos/evmos/v14 Package: github.com/evmos/evmos/v15 Package: github.com/evmos/evmos/v16 Package: github.com/evmos/evmos/v17 Package: github.com/evmos/evmos/v18 Package: github.com/evmos/evmos/v2 Package: github.com/evmos/evmos/v3 Package: github.com/evmos/evmos/v4 Package: github.com/evmos/evmos/v5 Package: github.com/evmos/evmos/v6 Package: github.com/evmos/evmos/v7 Package: github.com/evmos/evmos/v8 Package: github.com/evmos/evmos/v9 Ecosystem: Go

Description

Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. The spendable balance is not updated properly when delegating vested tokens. The issue allows a clawback vesting account to anticipate the release of unvested tokens. This vulnerability is fixed in 18.0.0.

Affected products

VendorProductAffectedFixed
evmos evmos < 18.0.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/evmos/evmos all versions — GO-2024-2891
Go github.com/evmos/evmos/v10 < 18.0.0 18.0.0 GHSA-pxv8-qhrh-jc7v
Go github.com/evmos/evmos/v10 all versions — GO-2024-2891
Go github.com/evmos/evmos/v11 < 18.0.0 18.0.0 GHSA-pxv8-qhrh-jc7v
Go github.com/evmos/evmos/v11 all versions — GO-2024-2891
Go github.com/evmos/evmos/v12 < 18.0.0 18.0.0 GHSA-pxv8-qhrh-jc7v
Go github.com/evmos/evmos/v12 all versions — GO-2024-2891
Go github.com/evmos/evmos/v13 < 18.0.0 18.0.0 GHSA-pxv8-qhrh-jc7v
Go github.com/evmos/evmos/v13 all versions — GO-2024-2891
Go github.com/evmos/evmos/v14 < 18.0.0 18.0.0 GHSA-pxv8-qhrh-jc7v
Go github.com/evmos/evmos/v14 all versions — GO-2024-2891
Go github.com/evmos/evmos/v15 < 18.0.0 18.0.0 GHSA-pxv8-qhrh-jc7v
Go github.com/evmos/evmos/v15 all versions — GO-2024-2891
Go github.com/evmos/evmos/v16 < 18.0.0 18.0.0 GHSA-pxv8-qhrh-jc7v
Go github.com/evmos/evmos/v16 all versions — GO-2024-2891
Go github.com/evmos/evmos/v17 < 18.0.0 18.0.0 GHSA-pxv8-qhrh-jc7v
Go github.com/evmos/evmos/v17 all versions — GO-2024-2891
Go github.com/evmos/evmos/v18 < 18.0.0 18.0.0 GO-2024-2891
Go github.com/evmos/evmos/v2 all versions — GO-2024-2891
Go github.com/evmos/evmos/v3 all versions — GO-2024-2891
Go github.com/evmos/evmos/v4 all versions — GO-2024-2891
Go github.com/evmos/evmos/v5 all versions — GO-2024-2891
Go github.com/evmos/evmos/v6 < 18.0.0 18.0.0 GHSA-pxv8-qhrh-jc7v
Go github.com/evmos/evmos/v6 all versions — GO-2024-2891
Go github.com/evmos/evmos/v7 < 18.0.0 18.0.0 GHSA-pxv8-qhrh-jc7v
Go github.com/evmos/evmos/v7 all versions — GO-2024-2891
Go github.com/evmos/evmos/v8 < 18.0.0 18.0.0 GHSA-pxv8-qhrh-jc7v
Go github.com/evmos/evmos/v8 all versions — GO-2024-2891
Go github.com/evmos/evmos/v9 < 18.0.0 18.0.0 GHSA-pxv8-qhrh-jc7v
Go github.com/evmos/evmos/v9 all versions — GO-2024-2891

References