GHSA-mjfq-3qr2-6g84: Github.com/cosmos/evm Cosmos EVM Allows Partial Precompile Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-mjfq-3qr2-6g84",
  "modified" : "2025-05-14T17:35:54Z",
  "published" : "2025-05-14T17:35:54Z",
  "aliases" : [ ],
  "summary" : "Cosmos EVM Allows Partial Precompile State Writes",
  "details" : "### Impact\nSetting lower EVM call gas allows users to partially execute precompiles and error at specific points in the precompile code without reverting the partially written state. \n\nIf executed on the distribution precompile when claiming funds, it could cause funds to be transferred to a user without resetting the claimable rewards to 0. The vulnerability could also be used to cause indeterministic execution by failing at other points in the code, halting validators.\n\nAny evmOS or Cosmos EVM chain using precompiles is affected.\n\n### Patches\nThe vulnerability was patched by wrapping each precompile execution into an atomic function that reverts any partially committed state on error.\n\n- [evmos/os](https://github.com/evmos/os) patch file: https://drive.google.com/file/d/1LfC0WSrQOqwTOW3qfaE6t8Jqf1PLVtS_/\n\nFor chains using a different file structure, you must manually apply the diff:\n\n### **In `x/evm/statedb.go`:**\n\nAdd the following function:\n```go\nfunc (s *StateDB) RevertMultiStore(cms storetypes.CacheMultiStore, events sdk.Events) {\n\ts.cacheCtx = s.cacheCtx.WithMultiStore(cms)\n\ts.writeCache = func() {\n\t\t// rollback the events to the ones\n\t\t// on the snapshot\n\t\ts.ctx.EventManager().EmitEvents(events)\n\t\tcms.Write()\n\t}\n}\n```\n\n### **In `x/evm/statedb/journal.go`:**\n\nReplace the `Revert` function with the following:\n```go\nfunc (pc precompileCallChange) Revert(s *StateDB) {\n\t// rollback multi store from cache ctx to the previous\n\t// state stored in the snapshot\n\ts.RevertMultiStore(pc.multiStore, pc.events)\n}\n```\n\n### **In `precompiles/common/precompile.go`:**\n\nChange the function signature in `HandleGasError` to:\n```go\nfunc HandleGasError(ctx sdk.Context, contract *vm.Contract, initialGas storetypes.Gas, err *error, stateDB *statedb.StateDB, snapshot snapshot) func() {\n...\n}\n```\n\nIn the `HandleGasError` function, add the following line in the switch statement in the `case storetypes.ErrorOutOfGas:` case:\n```go\nstateDB.RevertMultiStore(snapshot.MultiStore, snapshot.Events)\n```\n\nAdd the following function:\n```go\n// RunAtomic is used within the Run function of each Precompile implementation.\n// It handles rolling back to the provided snapshot if an error is returned from the core precompile logic.\n// Note: This is only required for stateful precompiles.\nfunc (p Precompile) RunAtomic(s snapshot, stateDB *statedb.StateDB, fn func() ([]byte, error)) ([]byte, error) {\n\tbz, err := fn()\n\tif err != nil {\n\t\t// revert to snapshot on error\n\t\tstateDB.RevertMultiStore(s.MultiStore, s.Events)\n\t}\n\treturn bz, err\n}\n```\n\n### **All Precompiles:**\nFinally, in each precompile, locate the `Run` function, and wrap each switch statement and return values into `p.RunAtomic`. For example:\n```go\n// Run executes the precompiled contract IBC transfer methods defined in the ABI.\nfunc (p Precompile) Run(evm *vm.EVM, contract *vm.Contract, readOnly bool) (bz []byte, err error) {\n\tctx, stateDB, snapshot, method, initialGas, args, err := p.RunSetup(evm, contract, readOnly, p.IsTransaction)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// This handles any out of gas errors that may occur during the execution of a precompile tx or query.\n\t// It avoids panics and returns the out of gas error so the EVM can continue gracefully.\n\tdefer cmn.HandleGasError(ctx, contract, initialGas, &err, stateDB, snapshot)()\n\n        // === WRAP HERE ===\n\treturn p.RunAtomic(snapshot, stateDB, func() ([]byte, error) {\n\t\tswitch method.Name {\n\t\t// TODO Approval transactions => need cosmos-sdk v0.46 & ibc-go v6.2.0\n\t\t// Authorization Methods:\n\t\tcase exampleCase:\n\t\t\tbz, err = p.example(ctx, evm.Origin, stateDB, method, args)\n\t\tdefault:\n\t\t\treturn nil, fmt.Errorf(cmn.ErrUnknownMethod, method.Name)\n\t\t}\n\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\tcost := ctx.GasMeter().GasConsumed() - initialGas\n\n\t\tif !contract.UseGas(cost) {\n\t\t\treturn nil, vm.ErrOutOfGas\n\t\t}\n\n\t\tif err := p.AddJournalEntries(stateDB, snapshot); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\treturn bz, nil\n\t})\n}\n```\n\n\n### Workarounds\nThere are no workarounds for chains that make use of precompiles. A coordinated upgrade is necessary to patch the issue.\n\n### Testing\nA test was introduced in the distribution precompile to ensure that partial state writes no longer occur when a lower gas amount is set.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/cosmos/evm"
    },
    "versions" : [ "0.1.0" ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/cosmos/evm/security/advisories/GHSA-mjfq-3qr2-6g84"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/cosmos/evm/commit/0fff8c144b24effbcb3addd666150ba5989d631c"
  }, {
    "type" : "WEB",
    "url" : "https://drive.google.com/file/d/1LfC0WSrQOqwTOW3qfaE6t8Jqf1PLVtS_"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/cosmos/evm"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-94" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-05-14T17:35:54Z",
    "nvd_published_at" : null
  }
}