{"answers":{"affected":"3 open source packages ship an affected version, including github.com/cosmos/evm.","exploited":"There is no known exploitation of GHSA-mjfq-3qr2-6g84 in the wild and no public exploit code.","fix":"No fix has been published for GHSA-mjfq-3qr2-6g84 yet. Limit exposure of the affected software until one is available.","what":"GHSA-mjfq-3qr2-6g84 is a vulnerability in github.com/cosmos/evm, published on 14 May 2025. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-mjfq-3qr2-6g84 and fix it if it is affected.\n\nWhat it is: GHSA-mjfq-3qr2-6g84 is a vulnerability in github.com/cosmos/evm, published on 14 May 2025. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-mjfq-3qr2-6g84 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/cosmos/evm (Go): affected all versions; no fix listed\n- github.com/cosmos/evm (Go): affected all versions; no fix listed\n- github.com/cosmos/evm (Go): affected all versions; no fix listed\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-mjfq-3qr2-6g84/ (Markdown: https://insights.sbomify.com/GHSA-mjfq-3qr2-6g84/index.md)","id":"GHSA-mjfq-3qr2-6g84","markdown":"https://insights.sbomify.com/GHSA-mjfq-3qr2-6g84/index.md","name":"GHSA-mjfq-3qr2-6g84","record":{"aliases":["GO-2025-3684"],"analysis":{"component_type":"server_software","fix_type":"patch","impacts":["data_modify","denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Cosmos EVM blockchain","requires_auth":"low_privilege","summary":"Attackers can exploit gas limits to partially execute precompiles, causing unauthorized fund transfers or halting validators via indeterministic execution.","user_interaction":"not_required","vuln_class":"business_logic"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\nSetting lower EVM call gas allows users to partially execute precompiles and error at specific points in the precompile code without reverting the partially written state. \n\nIf executed on the distribution precompile when claiming funds, it could cause funds to be transferred to a user without resetting the claimable rewards to 0. The vulnerability could also be used to cause indeterministic execution by failing at other points in the code, halting validators.\n\nAny evmOS or Cosmos EVM chain using precompiles is affected.\n\n### Patches\nThe vulnerability was patched by wrapping each precompile execution into an atomic function that reverts any partially committed state on error.\n\n- [evmos/os](https://github.com/evmos/os) patch file: https://drive.google.com/file/d/1LfC0WSrQOqwTOW3qfaE6t8Jqf1PLVtS_/\n\nFor chains using a different file structure, you must manually apply the diff:\n\n### **In `x/evm/statedb.go`:**\n\nAdd the following function:\n```go\nfunc (s *StateDB) RevertMultiStore(cms storetypes.CacheMultiStore, events sdk.Events) {\n\ts.cacheCtx = s.cacheCtx.WithMultiStore(cms)\n\ts.writeCache = func() {\n\t\t// rollback the events to the ones\n\t\t// on the snapshot\n\t\ts.ctx.EventManager().EmitEvents(events)\n\t\tcms.Write()\n\t}\n}\n```\n\n### **In `x/evm/statedb/journal.go`:**\n\nReplace the `Revert` function with the following:\n```go\nfunc (pc precompileCallChange) Revert(s *StateDB) {\n\t// rollback multi store from cache ctx to the previous\n\t// state stored in the snapshot\n\ts.RevertMultiStore(pc.multiStore, pc.events)\n}\n```\n\n### **In `precompiles/common/precompile.go`:**\n\nChange the function signature in `HandleGasError` to:\n```go\nfunc HandleGasError(ctx sdk.Context, contract *vm.Contract, initialGas storetypes.Gas, err *error, stateDB *statedb.StateDB, snapshot snapshot) func() {\n...\n}\n```\n\nIn the `HandleGasError` function, add the following line in the switch statement in the `case storetypes.ErrorOutOfGas:` case:\n```go\nstateDB.RevertMultiStore(snapshot.MultiStore, snapshot.Events)\n```\n\nAdd the following function:\n```go\n// RunAtomic is used within the Run function of each Precompile implementation.\n// It handles rolling back to the provided snapshot if an error is returned from the core precompile logic.\n// Note: This is only required for stateful precompiles.\nfunc (p Precompile) RunAtomic(s snapshot, stateDB *statedb.StateDB, fn func() ([]byte, error)) ([]byte, error) {\n\tbz, err := fn()\n\tif err != nil {\n\t\t// revert to snapshot on error\n\t\tstateDB.RevertMultiStore(s.MultiStore, s.Events)\n\t}\n\treturn bz, err\n}\n```\n\n### **All Precompiles:**\nFinally, in each precompile, locate the `Run` function, and wrap each switch statement and return values into `p.RunAtomic`. For example:\n```go\n// Run executes the precompiled contract IBC transfer methods defined in the ABI.\nfunc (p Precompile) Run(evm *vm.EVM, contract *vm.Contract, readOnly bool) (bz []byte, err error) {\n\tctx, stateDB, snapshot, method, initialGas, args, err := p.RunSetup(evm, contract, readOnly, p.IsTransaction)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// This handles any out of gas errors that may occur during the execution of a precompile tx or query.\n\t// It avoids panics and returns the out of gas error so the EVM can continue gracefully.\n\tdefer cmn.HandleGasError(ctx, contract, initialGas, \u0026err, stateDB, snapshot)()\n\n        // === WRAP HERE ===\n\treturn p.RunAtomic(snapshot, stateDB, func() ([]byte, error) {\n\t\tswitch method.Name {\n\t\t// TODO Approval transactions =\u003e need cosmos-sdk v0.46 \u0026 ibc-go v6.2.0\n\t\t// Authorization Methods:\n\t\tcase exampleCase:\n\t\t\tbz, err = p.example(ctx, evm.Origin, stateDB, method, args)\n\t\tdefault:\n\t\t\treturn nil, fmt.Errorf(cmn.ErrUnknownMethod, method.Name)\n\t\t}\n\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\tcost := ctx.GasMeter().GasConsumed() - initialGas\n\n\t\tif !contract.UseGas(cost) {\n\t\t\treturn nil, vm.ErrOutOfGas\n\t\t}\n\n\t\tif err := p.AddJournalEntries(stateDB, snapshot); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\treturn bz, nil\n\t})\n}\n```\n\n### Workarounds\nThere are no workarounds for chains that make use of precompiles. A coordinated upgrade is necessary to patch the issue.\n\n### Testing\nA test was introduced in the distribution precompile to ensure that partial state writes no longer occur when a lower gas amount is set.","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Cosmos EVM Allows Partial Precompile State Writes","id":"GHSA-mjfq-3qr2-6g84","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"business_logic","year":"2025"},"n_packages":3,"n_references":null,"packages":[{"ecosystem":"Go","fixed":[],"introduced":[],"last_affected":[],"package":"github.com/cosmos/evm","purl":null,"source":"GHSA-mjfq-3qr2-6g84"},{"ecosystem":"Go","fixed":[],"introduced":[],"last_affected":[],"package":"github.com/cosmos/evm","purl":"pkg:golang/github.com/cosmos/evm","source":"GHSA-mjfq-3qr2-6g84"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":[],"package":"github.com/cosmos/evm","purl":"pkg:golang/github.com/cosmos/evm","source":"GO-2025-3684"}],"products":null,"published":"2025-05-14","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can exploit gas limits to partially execute precompiles, causing unauthorized fund transfers or halting validators via indeterministic execution.","url":"https://insights.sbomify.com/GHSA-mjfq-3qr2-6g84/"}