GHSA-33cr-m232-xqch cheqd-node affected by Non-deterministic JSON Unmarshalling of IBC Acknowledgement
Attackers can halt the blockchain by exploiting non-deterministic JSON unmarshalling in IBC acknowledgements, requiring node operators to upgrade.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-33cr-m232-xqch?
GHSA-33cr-m232-xqch is an unsafe deserialization vulnerability in github.com/cheqd/cheqd-node, published on 11 Mar 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Description
An issue was discovered in IBC-Go's deserialization of acknowledgements that results in non-deterministic behavior which can halt a chain. Any user that can open an IBC channel can introduce this state to the chain.
This an upstream dependency used in cheqd-node, rather than a custom module.
Impact
Could result in a chain halt.
Patches
Validators, full nodes, and IBC relayers should upgrade to cheqd-node v3.1.7. This upgrade does not require a software upgrade proposal on-chain and is meant to be non state-breaking.
References
See ASA-2025-004: Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt upstream on IBC-Go.
Which versions are affected by GHSA-33cr-m232-xqch?
3 open source packages ship an affected version, including github.com/cheqd/cheqd-node.
| Package | Affected | Fixed in |
|---|---|---|
github.com/cheqd/cheqd-node Go | All versions | None |
github.com/cheqd/cheqd-node Go | All versions | 3.1.7 |
github.com/cheqd/cheqd-node Go | All versions | 3.1.7 |
How do I fix GHSA-33cr-m232-xqch?
Upgrade github.com/cheqd/cheqd-node to 3.1.7 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is GHSA-33cr-m232-xqch being exploited?
There is no known exploitation of GHSA-33cr-m232-xqch in the wild and no public exploit code.
Sources
Also known as GO-2025-3514.