# GHSA-mjfq-3qr2-6g84: Cosmos EVM Allows Partial Precompile State Writes

> Attackers can exploit gas limits to partially execute precompiles, causing unauthorized fund transfers or halting validators via indeterministic execution.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** No
- **Published:** 14 May 2025
- **Also known as:** GO-2025-3684

## What is GHSA-mjfq-3qr2-6g84?

GHSA-mjfq-3qr2-6g84 is a vulnerability in github.com/cosmos/evm, published on 14 May 2025. Any signed-in user can exploit it over the network, with no action from the victim.

### Official description

### Impact
Setting lower EVM call gas allows users to partially execute precompiles and error at specific points in the precompile code without reverting the partially written state. 

If executed on the distribution precompile when claiming funds, it could cause funds to be transferred to a user without resetting the claimable rewards to 0. The vulnerability could also be used to cause indeterministic execution by failing at other points in the code, halting validators.

Any evmOS or Cosmos EVM chain using precompiles is affected.

### Patches
The vulnerability was patched by wrapping each precompile execution into an atomic function that reverts any partially committed state on error.

- [evmos/os](https://github.com/evmos/os) patch file: https://drive.google.com/file/d/1LfC0WSrQOqwTOW3qfaE6t8Jqf1PLVtS_/

For chains using a different file structure, you must manually apply the diff:

### **In `x/evm/statedb.go`:**

Add the following function:
```go
func (s *StateDB) RevertMultiStore(cms storetypes.CacheMultiStore, events sdk.Events) {
	s.cacheCtx = s.cacheCtx.WithMultiStore(cms)
	s.writeCache = func() {
		// rollback the events to the ones
		// on the snapshot
		s.ctx.EventManager().EmitEvents(events)
		cms.Write()
	}
}
```

### **In `x/evm/statedb/journal.go`:**

Replace the `Revert` function with the following:
```go
func (pc precompileCallChange) Revert(s *StateDB) {
	// rollback multi store from cache ctx to the previous
	// state stored in the snapshot
	s.RevertMultiStore(pc.multiStore, pc.events)
}
```

### **In `precompiles/common/precompile.go`:**

Change the function signature in `HandleGasError` to:
```go
func HandleGasError(ctx sdk.Context, contract *vm.Contract, initialGas storetypes.Gas, err *error, stateDB *statedb.StateDB, snapshot snapshot) func() {
...
}
```

In the `HandleGasError` function, add the following line in the switch statement in the `case storetypes.ErrorOutOfGas:` case:
```go
stateDB.RevertMultiStore(snapshot.MultiStore, snapshot.Events)
```

Add the following function:
```go
// RunAtomic is used within the Run function of each Precompile implementation.
// It handles rolling back to the provided snapshot if an error is returned from the core precompile logic.
// Note: This is only required for stateful precompiles.
func (p Precompile) RunAtomic(s snapshot, stateDB *statedb.StateDB, fn func() ([]byte, error)) ([]byte, error) {
	bz, err := fn()
	if err != nil {
		// revert to snapshot on error
		stateDB.RevertMultiStore(s.MultiStore, s.Events)
	}
	return bz, err
}
```

### **All Precompiles:**
Finally, in each precompile, locate the `Run` function, and wrap each switch statement and return values into `p.RunAtomic`. For example:
```go
// Run executes the precompiled contract IBC transfer methods defined in the ABI.
func (p Precompile) Run(evm *vm.EVM, contract *vm.Contract, readOnly bool) (bz []byte, err error) {
	ctx, stateDB, snapshot, method, initialGas, args, err := p.RunSetup(evm, contract, readOnly, p.IsTransaction)
	if err != nil {
		return nil, err
	}

	// This handles any out of gas errors that may occur during the execution of a precompile tx or query.
	// It avoids panics and returns the out of gas error so the EVM can continue gracefully.
	defer cmn.HandleGasError(ctx, contract, initialGas, &err, stateDB, snapshot)()

        // === WRAP HERE ===
	return p.RunAtomic(snapshot, stateDB, func() ([]byte, error) {
		switch method.Name {
		// TODO Approval transactions => need cosmos-sdk v0.46 & ibc-go v6.2.0
		// Authorization Methods:
		case exampleCase:
			bz, err = p.example(ctx, evm.Origin, stateDB, method, args)
		default:
			return nil, fmt.Errorf(cmn.ErrUnknownMethod, method.Name)
		}

		if err != nil {
			return nil, err
		}

		cost := ctx.GasMeter().GasConsumed() - initialGas

		if !contract.UseGas(cost) {
			return nil, vm.ErrOutOfGas
		}

		if err := p.AddJournalEntries(stateDB, snapshot); err != nil {
			return nil, err
		}

		return bz, nil
	})
}
```

### Workarounds
There are no workarounds for chains that make use of precompiles. A coordinated upgrade is necessary to patch the issue.

### Testing
A test was introduced in the distribution precompile to ensure that partial state writes no longer occur when a lower gas amount is set.

## Which versions are affected by GHSA-mjfq-3qr2-6g84?

3 open source packages ship an affected version, including github.com/cosmos/evm.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `github.com/cosmos/evm` | Go | All versions | None |
| `github.com/cosmos/evm` | Go | All versions | None |
| `github.com/cosmos/evm` | Go | All versions | None |

## How do I fix GHSA-mjfq-3qr2-6g84?

No fix has been published for GHSA-mjfq-3qr2-6g84 yet. Limit exposure of the affected software until one is available.

## Is GHSA-mjfq-3qr2-6g84 being exploited?

There is no known exploitation of GHSA-mjfq-3qr2-6g84 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-mjfq-3qr2-6g84 and fix it if it is affected.

What it is: GHSA-mjfq-3qr2-6g84 is a vulnerability in github.com/cosmos/evm, published on 14 May 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-mjfq-3qr2-6g84 in the wild and no public exploit code.

Affected packages and fixed versions:
- github.com/cosmos/evm (Go): affected all versions; no fix listed
- github.com/cosmos/evm (Go): affected all versions; no fix listed
- github.com/cosmos/evm (Go): affected all versions; no fix listed

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-mjfq-3qr2-6g84/ (Markdown: https://insights.sbomify.com/GHSA-mjfq-3qr2-6g84/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-mjfq-3qr2-6g84

---
From sbomify Insights: https://insights.sbomify.com/GHSA-mjfq-3qr2-6g84/
Summaries are generated and may contain mistakes; the official description above is the record.