Description
Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. The spendable balance is not updated properly when delegating vested tokens. The issue allows a clawback vesting account to anticipate the release of unvested tokens. This vulnerability is fixed in 18.0.0.
Scores
CVSS v3
3.5
EPSS
0.0017
EPSS Percentile
38.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-682
Status
published
Products (2)
evmos/evmos
< 18.0.0
evmos/evmos
0 - 18.0.0 (12 CPE variants)Go
Published
Jun 06, 2024
Tracked Since
Feb 18, 2026