Skip to content
OpenAdvisories
Medium · 5.3 CVE-2024-37154 EUVD-2024-1962GHSA-7hrh-v6wp-53vwGO-2024-2904

Evmos allows unvested token delegations

Published Jun 6, 2024 · Updated Aug 2, 2024 · Assigned by GitHub_M

Vendor: evmos Product: evmos Package: github.com/evmos/evmos Package: github.com/evmos/evmos/v10 Package: github.com/evmos/evmos/v11 Package: github.com/evmos/evmos/v12 Package: github.com/evmos/evmos/v13 Package: github.com/evmos/evmos/v14 Package: github.com/evmos/evmos/v15 Package: github.com/evmos/evmos/v16 Package: github.com/evmos/evmos/v17 Package: github.com/evmos/evmos/v18 Package: github.com/evmos/evmos/v2 Package: github.com/evmos/evmos/v3 Package: github.com/evmos/evmos/v4 Package: github.com/evmos/evmos/v5 Package: github.com/evmos/evmos/v6 Package: github.com/evmos/evmos/v7 Package: github.com/evmos/evmos/v8 Package: github.com/evmos/evmos/v9 Ecosystem: Go

Description

Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. Users are able to delegate tokens that have not yet been vested. This affects employees and grantees who have funds managed via `ClawbackVestingAccount`. This affects 18.1.0 and earlier.

Affected products

VendorProductAffectedFixed
evmos evmos <= 18.1.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/evmos/evmos all versions — GO-2024-2904
Go github.com/evmos/evmos/v10 <= 10.0.1 — GHSA-7hrh-v6wp-53vw
Go github.com/evmos/evmos/v10 all versions — GO-2024-2904
Go github.com/evmos/evmos/v11 <= 11.0.2 — GHSA-7hrh-v6wp-53vw
Go github.com/evmos/evmos/v11 all versions — GO-2024-2904
Go github.com/evmos/evmos/v12 <= 12.1.6 — GHSA-7hrh-v6wp-53vw
Go github.com/evmos/evmos/v12 all versions — GO-2024-2904
Go github.com/evmos/evmos/v13 <= 13.0.2 — GHSA-7hrh-v6wp-53vw
Go github.com/evmos/evmos/v13 all versions — GO-2024-2904
Go github.com/evmos/evmos/v14 <= 14.1.0 — GHSA-7hrh-v6wp-53vw
Go github.com/evmos/evmos/v14 all versions — GO-2024-2904
Go github.com/evmos/evmos/v15 <= 15.0.0 — GHSA-7hrh-v6wp-53vw
Go github.com/evmos/evmos/v15 all versions — GO-2024-2904
Go github.com/evmos/evmos/v16 <= 16.0.4 — GHSA-7hrh-v6wp-53vw
Go github.com/evmos/evmos/v16 all versions — GO-2024-2904
Go github.com/evmos/evmos/v17 <= 17.0.1 — GHSA-7hrh-v6wp-53vw
Go github.com/evmos/evmos/v17 all versions — GO-2024-2904
Go github.com/evmos/evmos/v18 <= 18.1.0 — GHSA-7hrh-v6wp-53vw
Go github.com/evmos/evmos/v18 all versions — GO-2024-2904
Go github.com/evmos/evmos/v2 all versions — GO-2024-2904
Go github.com/evmos/evmos/v3 all versions — GO-2024-2904
Go github.com/evmos/evmos/v4 all versions — GO-2024-2904
Go github.com/evmos/evmos/v5 all versions — GO-2024-2904
Go github.com/evmos/evmos/v6 <= 6.0.4 — GHSA-7hrh-v6wp-53vw
Go github.com/evmos/evmos/v6 all versions — GO-2024-2904
Go github.com/evmos/evmos/v7 <= 7.0.0 — GHSA-7hrh-v6wp-53vw
Go github.com/evmos/evmos/v7 all versions — GO-2024-2904
Go github.com/evmos/evmos/v8 <= 8.2.3 — GHSA-7hrh-v6wp-53vw
Go github.com/evmos/evmos/v8 all versions — GO-2024-2904
Go github.com/evmos/evmos/v9 <= 9.1.0 — GHSA-7hrh-v6wp-53vw
Go github.com/evmos/evmos/v9 all versions — GO-2024-2904

References