CVE-2024-32873: Github.com/evmos/evmos/v17 Evmos Allows Transferring Unvested Tokens Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-pxv8-qhrh-jc7v",
  "modified" : "2024-09-06T21:40:06Z",
  "published" : "2024-06-06T18:21:05Z",
  "aliases" : [ "CVE-2024-32873" ],
  "summary" : "evmos allows transferring unvested tokens after delegations",
  "details" : "## Impact\n\nThis advisory has been created to address the following vulnerabilities found in the Evmos codebase and affecting vesting accounts.\n\n### Wrong spendable balance computation\n\nThe spendable balance is not updated properly when delegating vested tokens. The following example help in describing the issue:\n- Given a clawback vesting account with a starting `15M` vesting schedule. The initial spendable balance is `0`.\n- Time passes and `5M` are vested. The spendable balance is now `5M`.\n- The account delegate `5M`. The spendable balance should be `0`, but returns `5M`\n- The account can send `5M` to another account.\n\nThe issue allowed a clawback vesting account to anticipate the release of unvested tokens.\n\n### Missing precompile checks\n\nPreliminary checks on actions computed by the clawback vesting accounts are performed in the ante handler. Evmos core, implements two different ante handlers: one for Cosmos transactions and one for Ethereum transactions. Checks performed on the two implementation are different.\n\nThe vulnerability discovered allowed a clawback account to bypass Cosmos ante handler checks by sending an Ethereum transaction targeting a precompile used to interact with a Cosmos SDK module.\n\n### Missing create validator check\n\nThis vulnerability allowed a user to create a validator using vested tokens to deposit the self-bond.\n\n## Patches\n\n- The spendable balance function has been fixed correcting the `TrackDelegation` function.\n- The checks for the staking module, for the delegation and the create validator, has been moved into the `MsgServer` of a wrapper around the Cosmos SDK staking module. \n\nThe issues have been patched in versions >=V18.0.0.\n\n## References\n1. [Evmos vesting module](https://docs.evmos.org/protocol/modules/vesting)\n\n## For more information\nIf you have any questions or comments about this advisory:\n\nReach out to the Core Team in [Discord](https://discord.gg/evmos)\nOpen a discussion in [evmos/evmos](https://github.com/evmos/evmos/discussions)\nEmail us at [security@evmos.org](mailto:security@evmos.org) for security questions",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/evmos/evmos/v17"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "18.0.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 17.0.1"
    }
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/evmos/evmos/v16"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "18.0.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 16.0.4"
    }
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/evmos/evmos/v15"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "18.0.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 15.0.0"
    }
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/evmos/evmos/v14"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "18.0.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 14.1.0"
    }
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/evmos/evmos/v13"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "18.0.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 13.0.2"
    }
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/evmos/evmos/v12"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "18.0.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 12.1.6"
    }
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/evmos/evmos/v11"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "18.0.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 11.0.2"
    }
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/evmos/evmos/v10"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "18.0.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 10.0.1"
    }
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/evmos/evmos/v9"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "18.0.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 9.1.0"
    }
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/evmos/evmos/v8"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "18.0.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 8.2.3"
    }
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/evmos/evmos/v7"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "18.0.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 7.0.0"
    }
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/evmos/evmos/v6"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "18.0.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 6.0.4"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/evmos/evmos/security/advisories/GHSA-pxv8-qhrh-jc7v"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-32873"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-37158"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-37159"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/evmos/evmos/commit/b2a09ca66613d8b04decd3f2dcba8e1e77709dcb"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/evmos/evmos"
  }, {
    "type" : "WEB",
    "url" : "https://pkg.go.dev/vuln/GO-2024-2891"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-682" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-06-06T18:21:05Z",
    "nvd_published_at" : "2024-06-06T19:15:56Z"
  }
}