CVE-2024-32644 Information

Description

Evmos is a scalable high-throughput Proof-of-Stake EVM blockchain that is fully compatible and interoperable with Ethereum. Prior to 17.0.0 there is a way to mint arbitrary tokens due to the possibility to have two different states not in sync during the execution of a transaction. The exploit is based on the fact that to sync the Cosmos SDK state and the EVM one we rely on the stateDB.Commit() method. When we call this method we iterate though all the dirtyStorage and if and only if it is different than the originStorage we set the new state. Setting the new state means we update the Cosmos SDK KVStore. If a contract storage state that is the same before and after a transaction but is changed during the transaction and can call an external contract after the change it can be exploited to make the transaction similar to non-atomic. The vulnerability is critical since this could lead to drain of funds through creative SC interactions. The issue has been patched in versions >=V17.0.0.

Reference

https://github.com/evmos/evmos/security/advisories/GHSA-3fp5-2xwh-fxm6 https://github.com/evmos/evmos/commit/08982b5ee726b97bc50eaf58d1914829648b6a5f https://github.com/evmos/evmos/blob/b196a522ba4951890b40992e9f97aa610f8b5f9c/x/evm/statedb/statedb.go#L460-L465