GHSA-86h5-xcpx-cfqc ASA-2024-005: Potential slashing evasion during re-delegation

Q: Which versions are affected by GHSA-86h5-xcpx-cfqc?

5 open source packages ship an affected version, including github.com/cosmos/cosmos-sdk.

Q: Is GHSA-86h5-xcpx-cfqc being exploited?

There is no known exploitation of GHSA-86h5-xcpx-cfqc in the wild and no public exploit code.

Q: How do I fix GHSA-86h5-xcpx-cfqc?

Upgrade github.com/cosmos/cosmos-sdk to a fixed version for your release line: 0.47.10 or 0.50.5.

Not scored Published 27 Feb 2024

Attackers can evade slashing penalties for byzantine validator behavior by re-delegating before the penalty is applied, affecting Cosmos SDK users.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-86h5-xcpx-cfqc?

GHSA-86h5-xcpx-cfqc is a vulnerability in github.com/cosmos/cosmos-sdk, published on 27 Feb 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

ASA-2024-005: Potential slashing evasion during re-delegation

Component: Cosmos SDK Criticality: Low Affected Versions: Cosmos SDK versions <= 0.50.4; <= 0.47.9 Affected Users: Chain developers, Validator and Node operators Impact: Slashing Evasion

Summary

An issue was identified in the slashing mechanism that may allow for the evasion of slashing penalties during a slashing event. If a delegation contributed to byzantine behavior of a validator, and the validator has not yet been slashed, it may be possible for that delegation to evade a pending slashing penalty through re-delegation behavior. Additional validation logic was added to restrict this behavior.

Next Steps for Impacted Parties

If you are a chain developer on an affected version of the Cosmos SDK, it is advised to update to the latest available version of the Cosmos SDK for your project. Once a patched version is available, it is recommended that network operators upgrade.

A Github Security Advisory for this issue is available in the Cosmos-SDK repository. For more information about Cosmos SDK, see https://docs.cosmos.network/.

This issue was found by cat shark (Khanh) who reported it to the Cosmos Bug Bounty Program on HackerOne on December 6, 2023. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.

Which versions are affected by GHSA-86h5-xcpx-cfqc?