CVE-2024-32644

Description

Evmos is a scalable, high-throughput Proof-of-Stake EVM blockchain that is fully compatible and interoperable with Ethereum. Prior to 17.0.0, there is a way to mint arbitrary tokens due to the possibility to have two different states not in sync during the execution of a transaction. The exploit is based on the fact that to sync the Cosmos SDK state and the EVM one, we rely on the `stateDB.Commit()` method. When we call this method, we iterate though all the `dirtyStorage` and, **if and only if** it is different than the `originStorage`, we set the new state. Setting the new state means we update the Cosmos SDK KVStore. If a contract storage state that is the same before and after a transaction, but is changed during the transaction and can call an external contract after the change, it can be exploited to make the transaction similar to non-atomic. The vulnerability is **critical** since this could lead to drain of funds through creative SC interactions. The issue has been patched in versions >=V17.0.0.

CVSS v3.1 Score

9.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness Type (CWE)

CWE-662 CWE-662

Affected Products

Vendor	Product	Versions
evmos	evmos	< 17.0.0

References

Advisories & Patches

https://github.com/evmos/evmos/commit/08982b5ee726b97bc50eaf58d1914829648b6a5f https://github.com/evmos/evmos/security/advisories/GHSA-3fp5-2xwh-fxm6 https://github.com/evmos/evmos/commit/08982b5ee726b97bc50eaf58d1914829648b6a5f https://github.com/evmos/evmos/security/advisories/GHSA-3fp5-2xwh-fxm6

Other References

https://github.com/evmos/evmos/blob/b196a522ba4951890b40992e9f97aa610f8b5f9c/x/evm/statedb/statedb.go#L460-L465 https://github.com/evmos/evmos/blob/b196a522ba4951890b40992e9f97aa610f8b5f9c/x/evm/statedb/statedb.go#L460-L465

Frequently Asked Questions

What is CVE-2024-32644? +

Evmos is a scalable, high-throughput Proof-of-Stake EVM blockchain that is fully compatible and interoperable with Ethereum. Prior to 17.0.0, there is a way to mint arbitrary tokens due to the possibility to have two different states not in sync during the execution of a transaction. The exploit is based on the fact that to sync the Cosmos SDK state and the EVM one, we rely on the `stateDB.Commit()` method. When we call this method, we iterate though all the `dirtyStorage` and, **if and only if** it is different than the `originStorage`, we set the new state. Setting the new state means we update the Cosmos SDK KVStore. If a contract storage state that is the same before and after a transaction, but is changed during the transaction and can call an external contract after the change, it can be exploited to make the transaction similar to non-atomic. The vulnerability is **critical** since this could lead to drain of funds through creative SC interactions. The issue has been patched in versions >=V17.0.0. It has a CVSS v3.1 base score of 9.1 (CRITICAL).

How severe is CVE-2024-32644? +

CVE-2024-32644 has a CVSS v3.1 score of 9.1 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.

What products are affected by CVE-2024-32644? +

CVE-2024-32644 affects products from evmos, specifically: evmos. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-32644? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-7409 7.5

A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper …

CVE-2025-27104 7.5

vyper is a Pythonic Smart Contract Language for the EVM. Multiple evaluation of a single expression is possible in the …

CVE-2024-30387 6.5

A Missing Synchronization vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on ACX5448 and ACX710 allows …

CVE-2021-46939 5.5

In the Linux kernel, the following vulnerability has been resolved: tracing: Restructure trace_clock_global() to never block It was reported that …

CVE-2024-58131 4.0

FISCO BCOS 3.11.0 has an issue with synchronization of the transaction pool that can, for example, be observed when a …

CVE-2026-13489 3.1

A weakness has been identified in 78 xiaozhi-esp32 up to 2.2.6. Affected by this issue is the function ParseMessage of …