Advisories for Golang/Github.com/Evmos/Evmos/V14 package

2024

Evmos transaction execution not accounting for all state transition after interaction with precompiles

An external contributor, @iczc, discovered a way to mint arbitrary tokens due to the possibility to have two different states not in sync during the execution of a transaction. The exploit is based on the fact that to sync the Cosmos SDK state and the EVM one, we rely on the stateDB.Commit() method. When we call this method, we iterate though all the dirtyStorage and, if and only if it …