CVE-2024-37153

Summary

CVE-2024-37153 is a vulnerability affecting the Evmos platform on the Cosmos Network, which uses the Ethereum Virtual Machine (EVM) Hub. The issue arises when using Safe, a contract for liquid staking, and performing a local state change along with an Inter-Chain Standard (ICS20) transfer in the same function. This bug occurs when the contract address is used as the sender parameter in the ICS20 transfer using the ICS20 precompile. This vulnerability, known as the "infinite money glitch," allows contracts to effectively double the supply of Evmos after each transaction, posing a significant risk to the stability of the network. The issue has been addressed in versions V18.1.0 and above.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.