CVE-2024-32873 evmos allows transferring unvested tokens after delegations
Attackers can transfer unvested tokens by exploiting incorrect balance updates during delegation, allowing premature access to locked funds.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-32873?
CVE-2024-32873 is a low-severity vulnerability in evmos, published on 6 Jun 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. The spendable balance is not updated properly when delegating vested tokens. The issue allows a clawback vesting account to anticipate the release of unvested tokens. This vulnerability is fixed in 18.0.0.
Weakness: CWE-682
Which versions are affected by CVE-2024-32873?
It affects 1 product.
Products include Evmos Evmos.
How do I fix CVE-2024-32873?
Upgrade to a fixed version.
Is CVE-2024-32873 being exploited?
There is no known exploitation of CVE-2024-32873 in the wild and no public exploit code.
Other vulnerabilities in evmos
- CVE-2024-32644 Evmos' transaction execution not accounting for all state transition after interaction with precompiles
- CVE-2024-39696 Evmos vulnerable to exploit of smart contract account and vesting
- CVE-2022-24738 Account compromise in Evmos
- CVE-2024-37153 Evmos's contract balance not updating correctly after interchain transaction
- CVE-2024-37154 Evmos allows unvested token delegations