Vulnerability · Published Jun 6, 2024 · Assigned by GitHub_M
CVE-2024-32873evmos allows transferring unvested tokens after delegations
Low 3.5
In plain English
A low-severity security flaw in evmos from evmos. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.4%top 67.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. The spendable balance is not updated properly when delegating vested tokens. The issue allows a clawback vesting account to anticipate the release of unvested tokens. This vulnerability is fixed in 18.0.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/evmos/evmos | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v10 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v10 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v10 | 18.0.0 | GHSA-pxv8-qhrh-jc7v |
| Go | github.com/evmos/evmos/v10 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v11 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v11 | 18.0.0 | GHSA-pxv8-qhrh-jc7v |
| Go | github.com/evmos/evmos/v11 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v11 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v12 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v12 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v12 | 18.0.0 | GHSA-pxv8-qhrh-jc7v |
| Go | github.com/evmos/evmos/v12 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v13 | 18.0.0 | GHSA-pxv8-qhrh-jc7v |
| Go | github.com/evmos/evmos/v13 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v13 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v13 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v14 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v14 | 18.0.0 | GHSA-pxv8-qhrh-jc7v |
| Go | github.com/evmos/evmos/v14 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v14 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v15 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v15 | 18.0.0 | GHSA-pxv8-qhrh-jc7v |
| Go | github.com/evmos/evmos/v15 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v15 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v16 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v16 | 18.0.0 | GHSA-pxv8-qhrh-jc7v |
| Go | github.com/evmos/evmos/v16 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v16 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v17 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v17 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v17 | 18.0.0 | GHSA-pxv8-qhrh-jc7v |
| Go | github.com/evmos/evmos/v17 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v18 | 18.0.0 | GO-2024-2927 |
| Go | github.com/evmos/evmos/v18 | 18.0.0 | GO-2024-2891 |
| Go | github.com/evmos/evmos/v18 | 18.0.0 | GO-2024-2926 |
| Go | github.com/evmos/evmos/v2 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v2 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v2 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v3 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v3 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v3 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v4 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v4 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v4 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v5 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v5 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v5 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v6 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v6 | 18.0.0 | GHSA-pxv8-qhrh-jc7v |
| Go | github.com/evmos/evmos/v6 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v6 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v7 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v7 | 18.0.0 | GHSA-pxv8-qhrh-jc7v |
| Go | github.com/evmos/evmos/v7 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v7 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v8 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v8 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v8 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v8 | 18.0.0 | GHSA-pxv8-qhrh-jc7v |
| Go | github.com/evmos/evmos/v9 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v9 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v9 | 18.0.0 | GHSA-pxv8-qhrh-jc7v |
| Go | github.com/evmos/evmos/v9 | no fix listed | GO-2024-2927 |
Affected products (as reported)
Weakness: CWE-682 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
References
- https://github.com/evmos/evmos/security/advisories/GHSA-pxv8-qhrh-jc7v x_refsource_CONFIRM
- https://github.com/evmos/evmos/commit/b2a09ca66613d8b04decd3f2dcba8e1e77709dcb x_refsource_MISC