# GHSA-j496-crgh-34mx: ibc-go: Potential Reentrancy using Timeout Callbacks in ibc-hooks > Attackers can exploit reentrancy in IBC hooks to manipulate token transfers, potentially causing fund loss or unauthorized minting on affected blockchain networks. - **Severity:** Not scored - **Exploited in the wild:** Not known - **Login needed:** Any signed-in user - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 5 Apr 2024 - **Also known as:** GO-2024-2694 ## What is GHSA-j496-crgh-34mx? GHSA-j496-crgh-34mx is a vulnerability in github.com/cosmos/ibc-go, published on 5 Apr 2024. Any signed-in user can exploit it over the network, with no action from the victim. ### Official description **Name**: ASA-2024-007: Potential Reentrancy using Timeout Callbacks in ibc-hooks **Component**: ibc-go **Criticality**: Critical ([ACMv1](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md): I:Critical; L:AlmostCertain) **Affected versions**: < v4.6.0, < v5.4.0, < v6.3.0, < v7.4.0, < v8.2.0 **Affected users**: Chain Builders + Maintainers # Summary Through the deployment and subsequent use of a malicious CosmWasm contract via IBC interactions, an attacker could potentially execute the same `MsgTimeout` inside the IBC hook for the `OnTimeout` callback before the packet commitment is deleted. On chains where ibc-hooks wraps ICS-20, this vulnerability may allow for the logic of the `OnTimeout` callback of the transfer application to be recursively executed, leading to a condition that may present the opportunity for the loss of funds from the escrow account or unexpected minting of tokens. # Affected Configurations Chains which satisfy all of the following requirements are considered to be impacted by this vulnerability: * Chain is IBC-enabled and uses a vulnerable version of ibc-go * Chain is CosmWasm-enabled and allows code uploads for wasm contracts by anyone, or by authorized parties (to a lesser extent) * Chain utilizes the ibc-hooks middleware and wraps ICS-20 transfer application # Next Steps for Impacted Chain Builders and Maintainers It is advised to immediately upgrade to the latest patch fix version of ibc-go for your chain. If you have already applied a soft-patch through private coordination, we recommend additionally updating to the latest ibc-go version via normal software upgrade governance. If you have not upgraded your chain yet, and you desire to mitigate exposure to this vulnerability in the meantime, it is advisable to limit code uploading for contracts to trusted parties on your chain. **If your chain only allows permissioned, access-controlled contract uploads, it is still strongly recommended to update to the latest patched ibc-go version for your chain per your normal software upgrade process.** # Preparing for future coordination If your chain would like to be included in future coordination efforts, please ensure your chain has a prominently displayed or otherwise easily available up-to-date email address for technical security contact available. A security.md file in the root of your projects’ code repository should contain this information. Additionally, please test this security contact with an unaffiliated email to ensure it works as expected and can receive emails from outside of your domain. To ensure that your chain is included in future impact assessments, please keep your chain information up to date in the [Cosmos Chain Registry](https://github.com/cosmos/chain-registry) with code location, network name, and public RPC and API endpoints in the details. We recommend that all chains configure and practice the use of the [Circuit Breaker module](https://docs.cosmos.network/main/build/modules/circuit) in the Cosmos SDK, as future vulnerability notifications may require the use of this mechanism as a mitigation against exploitation. # Recognition This issue was reported to the Cosmos Bug Bounty Program on HackerOne on 3/26/24 by Maxwell Dulin (Strikeout) at [Asymmetric Research](https://www.asymmetric.re/). If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos. # Notes Due to the critical nature of this issue, both the ibc-go team and Amulet independently performed impact assessments for the ecosystem, which informed a risk-driven private patching effort that preceded this public release. This private patching effort significantly reduced the exposure of the ecosystem to this vulnerability. We appreciate the diligence and professionalism of all chains and validators involved with this effort – your ability to move quickly while maintaining confidentiality was instrumental in protecting the wider Interchain Ecosystem. If you ever have questions about security coordination efforts, public or private, please reach out to our official communication channel at [security@interchain.io](mailto:security@interchain.io). For more information about ibc-go, please see https://ibc.cosmos.network/main. For more information about the Interchain Foundation’s engagement with Amulet, please see https://github.com/interchainio/security. ## Which versions are affected by GHSA-j496-crgh-34mx? 24 open source packages ship an affected version, including github.com/cosmos/ibc-go, github.com/cosmos/ibc-go/v2 and github.com/cosmos/ibc-go/v3. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `github.com/cosmos/ibc-go` | Go | All versions | None | | `github.com/cosmos/ibc-go` | Go | All versions | None | | `github.com/cosmos/ibc-go` | Go | All versions | None | | `github.com/cosmos/ibc-go/v2` | Go | All versions | None | | `github.com/cosmos/ibc-go/v2` | Go | All versions | None | | `github.com/cosmos/ibc-go/v2` | Go | All versions | None | | `github.com/cosmos/ibc-go/v3` | Go | All versions | None | | `github.com/cosmos/ibc-go/v3` | Go | All versions | None | | `github.com/cosmos/ibc-go/v3` | Go | All versions | None | | `github.com/cosmos/ibc-go/v4` | Go | All versions | 4.6.0 | | `github.com/cosmos/ibc-go/v4` | Go | All versions | 4.6.0 | | `github.com/cosmos/ibc-go/v4` | Go | All versions | 4.6.0 | | `github.com/cosmos/ibc-go/v5` | Go | All versions | 5.4.0 | | `github.com/cosmos/ibc-go/v5` | Go | All versions | 5.4.0 | | `github.com/cosmos/ibc-go/v5` | Go | All versions | 5.4.0 | | `github.com/cosmos/ibc-go/v6` | Go | All versions | 6.3.0 | | `github.com/cosmos/ibc-go/v6` | Go | All versions | 6.3.0 | | `github.com/cosmos/ibc-go/v6` | Go | All versions | 6.3.0 | | `github.com/cosmos/ibc-go/v7` | Go | All versions | 7.4.0 | | `github.com/cosmos/ibc-go/v7` | Go | All versions | 7.4.0 | | `github.com/cosmos/ibc-go/v7` | Go | All versions | 7.4.0 | | `github.com/cosmos/ibc-go/v8` | Go | All versions | 8.2.0 | | `github.com/cosmos/ibc-go/v8` | Go | All versions | 8.2.0 | | `github.com/cosmos/ibc-go/v8` | Go | All versions | 8.2.0 | ## How do I fix GHSA-j496-crgh-34mx? Upgrade to a fixed version. ## Is GHSA-j496-crgh-34mx being exploited? There is no known exploitation of GHSA-j496-crgh-34mx in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for GHSA-j496-crgh-34mx and fix it if it is affected. What it is: GHSA-j496-crgh-34mx is a vulnerability in github.com/cosmos/ibc-go, published on 5 Apr 2024. Any signed-in user can exploit it over the network, with no action from the victim. Exploitation: There is no known exploitation of GHSA-j496-crgh-34mx in the wild and no public exploit code. Affected packages and fixed versions: - github.com/cosmos/ibc-go (Go): affected all versions; no fix listed - github.com/cosmos/ibc-go (Go): affected all versions; no fix listed - github.com/cosmos/ibc-go (Go): affected all versions; no fix listed - github.com/cosmos/ibc-go/v2 (Go): affected all versions; no fix listed - github.com/cosmos/ibc-go/v2 (Go): affected all versions; no fix listed - github.com/cosmos/ibc-go/v2 (Go): affected all versions; no fix listed - github.com/cosmos/ibc-go/v3 (Go): affected all versions; no fix listed - github.com/cosmos/ibc-go/v3 (Go): affected all versions; no fix listed - github.com/cosmos/ibc-go/v3 (Go): affected all versions; no fix listed - github.com/cosmos/ibc-go/v4 (Go): affected all versions; fixed in 4.6.0 - github.com/cosmos/ibc-go/v4 (Go): affected all versions; fixed in 4.6.0 - github.com/cosmos/ibc-go/v4 (Go): affected all versions; fixed in 4.6.0 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/GHSA-j496-crgh-34mx/ (Markdown: https://insights.sbomify.com/GHSA-j496-crgh-34mx/index.md) ``` ## Sources - OSV: https://osv.dev/vulnerability/GHSA-j496-crgh-34mx --- From sbomify Insights: https://insights.sbomify.com/GHSA-j496-crgh-34mx/ Summaries are generated and may contain mistakes; the official description above is the record.