CVE-2024-32644 Evmos' transaction execution not accounting for all state transition after interaction with precompiles

What is CVE-2024-32644?

CVE-2024-32644 is a critical vulnerability in evmos, published on 19 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Evmos is a scalable, high-throughput Proof-of-Stake EVM blockchain that is fully compatible and interoperable with Ethereum. Prior to 17.0.0, there is a way to mint arbitrary tokens due to the possibility to have two different states not in sync during the execution of a transaction. The exploit is based on the fact that to sync the Cosmos SDK state and the EVM one, we rely on the `stateDB.Commit()` method. When we call this method, we iterate though all the `dirtyStorage` and, **if and only if** it is different than the `originStorage`, we set the new state. Setting the new state means we update the Cosmos SDK KVStore. If a contract storage state that is the same before and after a transaction, but is changed during the transaction and can call an external contract after the change, it can be exploited to make the transaction similar to non-atomic. The vulnerability is **critical** since this could lead to drain of funds through creative SC interactions. The issue has been patched in versions >=V17.0.0.

Weakness: CWE-662

Which versions are affected by CVE-2024-32644?

40 open source packages ship an affected version, including github.com/evmos/evmos/v16, github.com/evmos/evmos and github.com/evmos/evmos/v10. It affects 1 product.

Products include Evmos Evmos.

How do I fix CVE-2024-32644?

Upgrade github.com/evmos/evmos/v16 to 17.0.0 or later.

Is CVE-2024-32644 being exploited?

There is no known exploitation of CVE-2024-32644 in the wild and no public exploit code.

Other vulnerabilities in evmos

• CVE-2024-39696 Evmos vulnerable to exploit of smart contract account and vesting High 8.8
• CVE-2022-24738 Account compromise in Evmos High 8.1
• CVE-2024-37153 Evmos's contract balance not updating correctly after interchain transaction High 7.5
• CVE-2024-37154 Evmos allows unvested token delegations Medium 5.3
• CVE-2024-37158 Evmos is missing precompile checks Low 3.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3fp5-2xwh-fxm6, GO-2024-2715.