CVE-2024-32873lowCWE-682

CVE-2024-32873: low-severity vulnerability in evmos

evmos allows transferring unvested tokens after delegations

Published · Updated

Follow this CVE+ Monitor evmos+ Monitor github.com/evmos/evmos

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.5epss 0.4%
Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. The spendable balance is not updated properly when delegating vested tokens. The issue allows a clawback vesting account to anticipate the release of unvested tokens. This vulnerability is fixed in 18.0.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Affected products
evmos · evmos
Related CVEs — evmos

In the same product, most dangerous first.

CVE-2024-32644CRITICALEvmos' transaction execution not accounting for all state transition after interaction with precompilesEPSS 0.9%CVE-2024-37153HIGHEvmos's contract balance not updating correctly after interchain transactionEPSS 0.6%CVE-2024-39696HIGHEvmos vulnerable to exploit of smart contract account and vestingEPSS 0.5%CVE-2024-37158LOWEvmos is missing precompile checksEPSS 0.4%CVE-2024-37154MEDIUMEvmos allows unvested token delegationsEPSS 0.4%CVE-2024-37159LOWEvmos is missing create validator checkEPSS 0.3%