GHSA-MJFQ-3QR2-6G84
Vulnerability from github – Published: 2025-05-14 17:35 – Updated: 2025-05-14 17:35
VLAI?
Summary
Cosmos EVM Allows Partial Precompile State Writes
Details
Impact
Setting lower EVM call gas allows users to partially execute precompiles and error at specific points in the precompile code without reverting the partially written state.
If executed on the distribution precompile when claiming funds, it could cause funds to be transferred to a user without resetting the claimable rewards to 0. The vulnerability could also be used to cause indeterministic execution by failing at other points in the code, halting validators.
Any evmOS or Cosmos EVM chain using precompiles is affected.
Patches
The vulnerability was patched by wrapping each precompile execution into an atomic function that reverts any partially committed state on error.
- evmos/os patch file: https://drive.google.com/file/d/1LfC0WSrQOqwTOW3qfaE6t8Jqf1PLVtS_/
For chains using a different file structure, you must manually apply the diff:
In x/evm/statedb.go:
Add the following function:
func (s *StateDB) RevertMultiStore(cms storetypes.CacheMultiStore, events sdk.Events) {
s.cacheCtx = s.cacheCtx.WithMultiStore(cms)
s.writeCache = func() {
// rollback the events to the ones
// on the snapshot
s.ctx.EventManager().EmitEvents(events)
cms.Write()
}
}
In x/evm/statedb/journal.go:
Replace the Revert function with the following:
func (pc precompileCallChange) Revert(s *StateDB) {
// rollback multi store from cache ctx to the previous
// state stored in the snapshot
s.RevertMultiStore(pc.multiStore, pc.events)
}
In precompiles/common/precompile.go:
Change the function signature in HandleGasError to:
func HandleGasError(ctx sdk.Context, contract *vm.Contract, initialGas storetypes.Gas, err *error, stateDB *statedb.StateDB, snapshot snapshot) func() {
...
}
In the HandleGasError function, add the following line in the switch statement in the case storetypes.ErrorOutOfGas: case:
stateDB.RevertMultiStore(snapshot.MultiStore, snapshot.Events)
Add the following function:
// RunAtomic is used within the Run function of each Precompile implementation.
// It handles rolling back to the provided snapshot if an error is returned from the core precompile logic.
// Note: This is only required for stateful precompiles.
func (p Precompile) RunAtomic(s snapshot, stateDB *statedb.StateDB, fn func() ([]byte, error)) ([]byte, error) {
bz, err := fn()
if err != nil {
// revert to snapshot on error
stateDB.RevertMultiStore(s.MultiStore, s.Events)
}
return bz, err
}
All Precompiles:
Finally, in each precompile, locate the Run function, and wrap each switch statement and return values into p.RunAtomic. For example:
// Run executes the precompiled contract IBC transfer methods defined in the ABI.
func (p Precompile) Run(evm *vm.EVM, contract *vm.Contract, readOnly bool) (bz []byte, err error) {
ctx, stateDB, snapshot, method, initialGas, args, err := p.RunSetup(evm, contract, readOnly, p.IsTransaction)
if err != nil {
return nil, err
}
// This handles any out of gas errors that may occur during the execution of a precompile tx or query.
// It avoids panics and returns the out of gas error so the EVM can continue gracefully.
defer cmn.HandleGasError(ctx, contract, initialGas, &err, stateDB, snapshot)()
// === WRAP HERE ===
return p.RunAtomic(snapshot, stateDB, func() ([]byte, error) {
switch method.Name {
// TODO Approval transactions => need cosmos-sdk v0.46 & ibc-go v6.2.0
// Authorization Methods:
case exampleCase:
bz, err = p.example(ctx, evm.Origin, stateDB, method, args)
default:
return nil, fmt.Errorf(cmn.ErrUnknownMethod, method.Name)
}
if err != nil {
return nil, err
}
cost := ctx.GasMeter().GasConsumed() - initialGas
if !contract.UseGas(cost) {
return nil, vm.ErrOutOfGas
}
if err := p.AddJournalEntries(stateDB, snapshot); err != nil {
return nil, err
}
return bz, nil
})
}
Workarounds
There are no workarounds for chains that make use of precompiles. A coordinated upgrade is necessary to patch the issue.
Testing
A test was introduced in the distribution precompile to ensure that partial state writes no longer occur when a lower gas amount is set.
Severity ?
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/cosmos/evm"
},
"versions": [
"0.1.0"
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2025-05-14T17:35:54Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\nSetting lower EVM call gas allows users to partially execute precompiles and error at specific points in the precompile code without reverting the partially written state. \n\nIf executed on the distribution precompile when claiming funds, it could cause funds to be transferred to a user without resetting the claimable rewards to 0. The vulnerability could also be used to cause indeterministic execution by failing at other points in the code, halting validators.\n\nAny evmOS or Cosmos EVM chain using precompiles is affected.\n\n### Patches\nThe vulnerability was patched by wrapping each precompile execution into an atomic function that reverts any partially committed state on error.\n\n- [evmos/os](https://github.com/evmos/os) patch file: https://drive.google.com/file/d/1LfC0WSrQOqwTOW3qfaE6t8Jqf1PLVtS_/\n\nFor chains using a different file structure, you must manually apply the diff:\n\n### **In `x/evm/statedb.go`:**\n\nAdd the following function:\n```go\nfunc (s *StateDB) RevertMultiStore(cms storetypes.CacheMultiStore, events sdk.Events) {\n\ts.cacheCtx = s.cacheCtx.WithMultiStore(cms)\n\ts.writeCache = func() {\n\t\t// rollback the events to the ones\n\t\t// on the snapshot\n\t\ts.ctx.EventManager().EmitEvents(events)\n\t\tcms.Write()\n\t}\n}\n```\n\n### **In `x/evm/statedb/journal.go`:**\n\nReplace the `Revert` function with the following:\n```go\nfunc (pc precompileCallChange) Revert(s *StateDB) {\n\t// rollback multi store from cache ctx to the previous\n\t// state stored in the snapshot\n\ts.RevertMultiStore(pc.multiStore, pc.events)\n}\n```\n\n### **In `precompiles/common/precompile.go`:**\n\nChange the function signature in `HandleGasError` to:\n```go\nfunc HandleGasError(ctx sdk.Context, contract *vm.Contract, initialGas storetypes.Gas, err *error, stateDB *statedb.StateDB, snapshot snapshot) func() {\n...\n}\n```\n\nIn the `HandleGasError` function, add the following line in the switch statement in the `case storetypes.ErrorOutOfGas:` case:\n```go\nstateDB.RevertMultiStore(snapshot.MultiStore, snapshot.Events)\n```\n\nAdd the following function:\n```go\n// RunAtomic is used within the Run function of each Precompile implementation.\n// It handles rolling back to the provided snapshot if an error is returned from the core precompile logic.\n// Note: This is only required for stateful precompiles.\nfunc (p Precompile) RunAtomic(s snapshot, stateDB *statedb.StateDB, fn func() ([]byte, error)) ([]byte, error) {\n\tbz, err := fn()\n\tif err != nil {\n\t\t// revert to snapshot on error\n\t\tstateDB.RevertMultiStore(s.MultiStore, s.Events)\n\t}\n\treturn bz, err\n}\n```\n\n### **All Precompiles:**\nFinally, in each precompile, locate the `Run` function, and wrap each switch statement and return values into `p.RunAtomic`. For example:\n```go\n// Run executes the precompiled contract IBC transfer methods defined in the ABI.\nfunc (p Precompile) Run(evm *vm.EVM, contract *vm.Contract, readOnly bool) (bz []byte, err error) {\n\tctx, stateDB, snapshot, method, initialGas, args, err := p.RunSetup(evm, contract, readOnly, p.IsTransaction)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// This handles any out of gas errors that may occur during the execution of a precompile tx or query.\n\t// It avoids panics and returns the out of gas error so the EVM can continue gracefully.\n\tdefer cmn.HandleGasError(ctx, contract, initialGas, \u0026err, stateDB, snapshot)()\n\n // === WRAP HERE ===\n\treturn p.RunAtomic(snapshot, stateDB, func() ([]byte, error) {\n\t\tswitch method.Name {\n\t\t// TODO Approval transactions =\u003e need cosmos-sdk v0.46 \u0026 ibc-go v6.2.0\n\t\t// Authorization Methods:\n\t\tcase exampleCase:\n\t\t\tbz, err = p.example(ctx, evm.Origin, stateDB, method, args)\n\t\tdefault:\n\t\t\treturn nil, fmt.Errorf(cmn.ErrUnknownMethod, method.Name)\n\t\t}\n\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\tcost := ctx.GasMeter().GasConsumed() - initialGas\n\n\t\tif !contract.UseGas(cost) {\n\t\t\treturn nil, vm.ErrOutOfGas\n\t\t}\n\n\t\tif err := p.AddJournalEntries(stateDB, snapshot); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\treturn bz, nil\n\t})\n}\n```\n\n\n### Workarounds\nThere are no workarounds for chains that make use of precompiles. A coordinated upgrade is necessary to patch the issue.\n\n### Testing\nA test was introduced in the distribution precompile to ensure that partial state writes no longer occur when a lower gas amount is set.",
"id": "GHSA-mjfq-3qr2-6g84",
"modified": "2025-05-14T17:35:54Z",
"published": "2025-05-14T17:35:54Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cosmos/evm/security/advisories/GHSA-mjfq-3qr2-6g84"
},
{
"type": "WEB",
"url": "https://github.com/cosmos/evm/commit/0fff8c144b24effbcb3addd666150ba5989d631c"
},
{
"type": "WEB",
"url": "https://drive.google.com/file/d/1LfC0WSrQOqwTOW3qfaE6t8Jqf1PLVtS_"
},
{
"type": "PACKAGE",
"url": "https://github.com/cosmos/evm"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Cosmos EVM Allows Partial Precompile State Writes"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…