Summary
Account compromise in Evmos
Classification
The vulnerability has been classified as critical with a score of 9.0 (highest). It has the potential to affect and drain unclaimed airdrop funds from Cosmos and Osmosis eligible user addresses.
Disclosure
The attack requires advanced knowledge of the internals of the core and application packages of IBC, IBC relayers, the Cosmos SDK AnteHandler, and the Evmos x/claims module. The step-by-step attack is described below:
- An actor creates a malicious chain with a custom
AnteHandlerthat skips signature verification for transactions, specifically IBCMsgTransfer. This allows the attacker to impersonate any account by setting a customsenderaddress field of the IBC transfer message. - The malicious actor then connects this newly created chain via IBC to Evmos and fills the
recipientaddress from the transfer message with an address they control. - Once the IBC packet containing the Transfer data is relayed to Evmos, it is processed by the claims module IBC middleware. Which migrates the claim records to the recipient address, which is owned by the attacker.
- The attacker then performs two airdrop Actions, claiming up to 75% of the total initial claimable amount.
- The Actor repeats steps 1., 2., and 3. for every address that has unclaimed funds from the airdrop. This automatically claims 75% of the unclaimable amount.
- The malicious actor performs the final Action, claiming 100% of all the user funds.
- Then, the attacker transfers the funds to another chain with a DEX (Osmosis, Cosmos Hub) via IBC.
- Finally, the attacker withdraws the total amount in fiat through a centralized exchange.
Users impacted
No users have suffered the loss of funds as no malicious chains have been connected to Evmos.
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
No, the fix for the critical vulnerability is state machine breaking. An upgrade procedure must be coordinated with the nodes running the network.
References
Are there any links users can visit to find out more?
- Claims module spec: evmos.dev/modules/claims
- Cosmos SDK documentation: docs.cosmos.network
- IBC documentation: ibc.cosmos.network
For more information
If you have any questions or comments about this advisory:
- Reach out to the Core Team in Discord
- Open an issue in tharsis/evmos
- Email us at [email protected]
Thanks to the Core IBC team at Interchain GmbH for the secure disclosure of this vulnerability
Impact
What kind of vulnerability is it? Who is impacted?
The application does not adequately verify the identity of a user, device, or process before granting access. Typical impact: unauthorized access to functions or data reserved for authenticated parties.
CVE-2022-24738 has a CVSS score of 7.4 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2.0.1); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Has the problem been patched? What versions should users upgrade to?
The patch involves defining a list of authorized channels for chains that are connected to Evmos via IBC. This restricts the chains that have the capability of migrating users' claims records as per the specification. By default, the authorized destination channels are "channel-0" (Osmosis) and "channel-3" (Cosmos Hub).
Please upgrade your mainnet node and validator to v2.0.1 ASAP.
Frequently Asked Questions
- What is CVE-2022-24738? CVE-2022-24738 is a high-severity improper authentication vulnerability in github.com/tharsis/evmos (go), affecting versions < 2.0.1. It is fixed in 2.0.1. The application does not adequately verify the identity of a user, device, or process before granting access.
- How severe is CVE-2022-24738? CVE-2022-24738 has a CVSS score of 7.4 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of github.com/tharsis/evmos are affected by CVE-2022-24738? github.com/tharsis/evmos (go) versions < 2.0.1 is affected.
- Is there a fix for CVE-2022-24738? Yes. CVE-2022-24738 is fixed in 2.0.1. Upgrade to this version or later.
- Is CVE-2022-24738 exploitable, and should I be worried? Whether CVE-2022-24738 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2022-24738 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2022-24738? Upgrade
github.com/tharsis/evmosto 2.0.1 or later.