CVE-2024-37158 - CVE House
Back to Database
Status published Low CVE-2024-37158

Evmos is missing precompile checks

Vulnerability Description

Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. Preliminary checks on actions computed by the clawback vesting accounts are performed in the ante handler. Evmos core, implements two different ante handlers: one for Cosmos transactions and one for Ethereum transactions. Checks performed on the two implementation are different. The vulnerability discovered allowed a clawback account to bypass Cosmos ante handler checks by sending an Ethereum transaction targeting a precompile used to interact with a Cosmos SDK module. This vulnerability is fixed in 18.0.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-37158

Credits & Attribution

No credits recorded in the NVD database.

References

More from evmos

View All →
CVE-2024-39696
Evmos vulnerable to exploit of smart contract account and vesting
High 8.8
CVE-2024-37159
Evmos is missing create validator check
Low 3.5
CVE-2024-37154
Evmos allows unvested token delegations
Medium 5.3
CVE-2024-37153
Evmos's contract balance not updating correctly after interchain transaction
High 7.5
CVE-2024-32873
evmos allows transferring unvested tokens after delegations
Low 3.5

Affected Vendor

Affected Software

evmos
Vulnerable Versions:
< 18.0.0

Timeline

Official Publish: June 17th, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Weaknesses (CWE)

CWE-691

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.