Description
Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. In versions of evmos prior to 2.0.1 attackers are able to drain unclaimed funds from user addresses. To do this an attacker must create a new chain which does not enforce signature verification and connects it to the target evmos instance. The attacker can use this joined chain to transfer unclaimed funds. Users are advised to upgrade. There are no known workarounds for this issue.
References (3)
Core 3
Core References
Third Party Advisory x_refsource_confirm
https://github.com/tharsis/evmos/security/advisories/GHSA-5jgq-x857-p8xw
Patch, Third Party Advisory x_refsource_misc
https://github.com/tharsis/evmos/commit/28870258d4ee9f1b8aeef5eba891681f89348f71
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/tharsis/evmos/releases/tag/v2.0.1
Scores
CVSS v3
8.1
EPSS
0.0027
EPSS Percentile
50.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-287
Status
published
Products (2)
evmos/evmos
< 2.0.1
tharsis/evmos
0 - 2.0.1Go
Published
Mar 07, 2022
Tracked Since
Feb 18, 2026