GHSA-86h5-xcpx-cfqc

Source

https://github.com/advisories/GHSA-86h5-xcpx-cfqc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-86h5-xcpx-cfqc/GHSA-86h5-xcpx-cfqc.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-86h5-xcpx-cfqc

Aliases

GO-2024-2584

Published

2024-02-27T21:55:52Z

Modified

2024-11-04T17:14:28Z

Summary

ASA-2024-005: Potential slashing evasion during re-delegation

Details

ASA-2024-005: Potential slashing evasion during re-delegation

Component: Cosmos SDK Criticality: Low Affected Versions: Cosmos SDK versions <= 0.50.4; <= 0.47.9 Affected Users: Chain developers, Validator and Node operators Impact: Slashing Evasion

Summary

An issue was identified in the slashing mechanism that may allow for the evasion of slashing penalties during a slashing event. If a delegation contributed to byzantine behavior of a validator, and the validator has not yet been slashed, it may be possible for that delegation to evade a pending slashing penalty through re-delegation behavior. Additional validation logic was added to restrict this behavior.

Next Steps for Impacted Parties

If you are a chain developer on an affected version of the Cosmos SDK, it is advised to update to the latest available version of the Cosmos SDK for your project. Once a patched version is available, it is recommended that network operators upgrade.

A Github Security Advisory for this issue is available in the Cosmos-SDK repository. For more information about Cosmos SDK, see https://docs.cosmos.network/.

This issue was found by cat shark (Khanh) who reported it to the Cosmos Bug Bounty Program on HackerOne on December 6, 2023. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-372"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-27T21:55:52Z"
}

References

Affected packages

Go / github.com/cosmos/cosmos-sdk

Package

Name: github.com/cosmos/cosmos-sdk; View open source insights on deps.dev
Purl: pkg:golang/github.com/cosmos/cosmos-sdk

Affected ranges

Type: SEMVER
Events: Introduced

0.50.0

Fixed

0.50.5

Database specific

{
    "last_known_affected_version_range": "<= 0.50.4"
}

Go / github.com/cosmos/cosmos-sdk

Package

Name: github.com/cosmos/cosmos-sdk; View open source insights on deps.dev
Purl: pkg:golang/github.com/cosmos/cosmos-sdk

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.47.10

Database specific

{
    "last_known_affected_version_range": "<= 0.47.9"
}