CVE-2021-25837 Business logic in n/a
Attackers can exploit cache lifecycle inconsistencies in Ethermint to improperly reserve storage changes from failed transactions, enabling arbitrary token minting.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-25837?
CVE-2021-25837 is a high-severity vulnerability in n/a, published on 8 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Cosmos Network Ethermint <= v0.4.0 is affected by cache lifecycle inconsistency in the EVM module. Due to the inconsistency between the Storage caching cycle and the Tx processing cycle, Storage changes caused by a failed transaction are improperly reserved in memory. Although the bad storage cache data will be discarded at EndBlock, it is still valid in the current block, which enables many possible attacks such as an "arbitrary mint token".
Which versions are affected by CVE-2021-25837?
It affects 1 product.
Products include Chainsafe Ethermint.
How do I fix CVE-2021-25837?
No fix has been published for CVE-2021-25837 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-25837 being exploited?
There is no known exploitation of CVE-2021-25837 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.