Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable
A critical balance-handling flaw (GHSA-7g4w-cg88-2cq2) in the shared Cosmos EVM module was exploited to drain funds from six blockchains between August 20–25, 2026, despite Cosmos Labs being aware of the vulnerability since April 25, 2026. The root cause is an unchecked subtraction in the post-delegation write-back logic: when a vesting account delegates more than its spendable balance, the balance wraps to approximately 2^256, enabling attackers to mint or burn funds through the EVM-Cosmos SDK
72
Hot
62
Quality
58
Impact
Analysis
TL;DR
- A critical balance-handling flaw (GHSA-7g4w-cg88-2cq2) in the shared Cosmos EVM module was exploited to drain funds from six blockchains between August 20–25, 2026, despite Cosmos Labs being aware of the vulnerability since April 25, 2026.
- The root cause is an unchecked subtraction in the post-delegation write-back logic: when a vesting account delegates more than its spendable balance, the balance wraps to approximately 2^256, enabling attackers to mint or burn funds through the EVM-Cosmos SDK reconciliation mechanism.
- Cosmos Labs incorrectly assessed the vulnerability as affecting only non-18-decimal networks in April, later confirmed all EVM chains were affected by August 13, yet routed the fix through a "silent patch" process reserved for non-fund-risk issues rather than emergency private distribution.
- The fix (v0.6.2 and v0.7.2) is state-breaking and requires a coordinated network upgrade; chains unable to upgrade must halt block production, and operators are advised to reject vesting account creation messages in the ante handler as an interim measure.
- Additional unpatched gaps persist: cherry-picked fixes may leave duplicate unexported code paths vulnerable, two critical balance fixes were omitted from the advisory, and eleven Cosmos EVM deployments were discovered that had never registered security contacts with Cosmos Labs.
Why It Matters
This incident exposes a dangerous gap between vulnerability discovery and responsible disclosure in the Cosmos ecosystem, where a known critical flaw threatening live user funds was treated with a silent patch process instead of emergency private distribution. It also highlights systemic risks in shared modular infrastructure: a single bug in a commonly reused EVM module can compromise multiple independent blockchains simultaneously, and fork-based deployments may silently retain unpatched code paths despite upstream fixes.
Technical Details
- Vulnerability mechanism: The
EVMStateDBtracks only an account's spendable balance, while SDK vesting accounts maintain both spendable and locked balances. Bothx/stakingand the staking precompile allow delegation of locked portions. When a vesting account delegates beyond its spendable balance, the unchecked post-delegation write-back subtracts the full delegated amount from the smaller spendable figure, causing an underflow that wraps the balance to ~2^256. - Exploitation vector: The attacker deploys a contract on a precomputed address converted into a vesting account, then executes a single transaction containing two halves with net zero supply change: one half mints funds via the wrapped balance, the other burns a victim's real holdings by sending them
2^256 - balance. Exploitation requires chains to permit permissionless vesting-account creation. - Version-specific behavior: On 0.6.x chains, large mint operations cause supply overflows that halt the chain. On 0.7.x chains, balances are set directly in
x/bankand surviveuint256toint256conversion, allowing direct fund drainage. - Fixes and gaps: The documented fix (PR #1176, merged May 15, backported August 13) adds a
SubBalanceunderflow guard. Two additional fixes—PR #1187 (locked-balance snapshot, May 20) and commit 3524ebc (module-account balance guard)—were not mentioned in the advisory. Forks like ZetaChain's cherry-picked patch left duplicate unexported helpers unpatched, while Warden Protocol blocked vesting account creation entirely. - Affected versions:
< 0.6.2and>= 0.7.0 < 0.7.2; fixed releases arev0.6.2andv0.7.2(August 19).
Industry Insight
- Shared module risk demands coordinated security: The Cosmos EVM flaw demonstrates how a single vulnerability in a shared dependency can cascade across dozens of independent chains. Projects using modular components must treat upstream security advisories as critical infrastructure alerts and verify that their forked code paths are fully patched, not just test-passing.
- Vesting account permissions are a attack surface: Chains permitting permissionless vesting-account creation should immediately restrict
MsgCreateVestingAccount,MsgCreatePermanentLockedAccount, andMsgCreatePeriodicVestingAccountin their ante handlers, or restrict vesting creation to genesis-only, until the underlying module is patched. - Responsible disclosure processes must match threat severity: Cosmos Labs' decision to apply a "silent patch" process to a known fund-threatening vulnerability—contradicting its own published policy for emergency mitigations—suggests a need for automated severity-to-response mapping in bug bounty programs, ensuring that critical fund-risk flaws trigger private distribution regardless of prior patch visibility.
Disclaimer: The above content is generated by AI and is for reference only.
Security
Related Articles
The Second Half of the AI War: No Longer About Who Has the Strongest Model, But Who Can Use It
Trump blacklisting of "woke" Anthropic deemed illegal by federal judge
5 lessons from the OpenAI / Hugging Face incident
Just a rumour of a bug is enough to find a security exploit these days
Cities terminate Flock contracts at record pace in August