Ethermint DoS through Unintended Contract Selfdestruct
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Ethermint is an Ethereum library. In Ethermint running versions before `v0.17.2`, the contract `selfdestruct` invocation permanently removes the corresponding bytecode from the internal database storage. However, due to a bug in the `DeleteAccount`function, all contracts that used the identical bytecode (i.e shared the same `CodeHash`) will also stop working once one contract invokes `selfdestruct`, even though the other contracts did not invoke the `selfdestruct` OPCODE. This vulnerability has been patched in Ethermint version v0.18.0. The patch has state machine-breaking changes for applications using Ethermint, so a coordinated upgrade procedure is required. A workaround is available. If a contract is subject to DoS due to this issue, the user can redeploy the same contract, i.e. with identical bytecode, so that the original contract's code is recovered. The new contract deployment restores the `bytecode hash -> bytecode` entry in the internal state.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| evmos | ethermint | up to 0.17.2 | — | No fix listed | CNA |
| — | github.com/evmos/ethermint (Go) | before 0.18.0 | 0.18.0 | Patch available | GHSA-f92v-grc2-w2fg |
| — | github.com/evmos/evmos (Go) | before 7.0.0 | 7.0.0 | Patch available | GHSA-f92v-grc2-w2fg |
| — | github.com/crypto-org-chain/cronos (Go) | before 0.7.1-rc2 | 0.7.1-rc2 | Patch available | GHSA-f92v-grc2-w2fg |
| — | github.com/Kava-Labs/kava (Go) | before 0.18.0 | 0.18.0 | Patch available | GHSA-f92v-grc2-w2fg |
- ethermint Vendorevmos Affected up to 0.17.2 Fixed in — No fix listed CNA
- github.com/evmos/ethermint (Go) Vendor— Affected before 0.18.0 Fixed in 0.18.0 Patch available GHSA-f92v-grc2-w2fg
- github.com/evmos/evmos (Go) Vendor— Affected before 7.0.0 Fixed in 7.0.0 Patch available GHSA-f92v-grc2-w2fg
- github.com/crypto-org-chain/cronos (Go) Vendor— Affected before 0.7.1-rc2 Fixed in 0.7.1-rc2 Patch available GHSA-f92v-grc2-w2fg
- github.com/Kava-Labs/kava (Go) Vendor— Affected before 0.18.0 Fixed in 0.18.0 Patch available GHSA-f92v-grc2-w2fg
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:evmos:ethermint:*:*:*:*:*:*:*:* | before 0.18.0 | Vulnerable | evmos |
| cpe:2.3:a:kava:kava:*:*:*:*:*:*:*:* | before 0.18.0 | Vulnerable | Kava |
| cpe:2.3:a:crypto:cronos:*:*:*:*:*:*:*:* | up to 0.7.0 | Vulnerable | Crypto |
| cpe:2.3:a:evmos:evmos:*:*:*:*:*:*:*:* | before 7.0.0 | Vulnerable | evmos |
- cpe:2.3:a:evmos:ethermint:*:*:*:*:*:*:*:* Versions before 0.18.0 Vulnerable ·evmos
- cpe:2.3:a:kava:kava:*:*:*:*:*:*:*:* Versions before 0.18.0 Vulnerable ·Kava
- cpe:2.3:a:crypto:cronos:*:*:*:*:*:*:*:* Versions up to 0.7.0 Vulnerable ·Crypto
- cpe:2.3:a:evmos:evmos:*:*:*:*:*:*:*:* Versions before 7.0.0 Vulnerable ·evmos
Remediation
- Fix · GHSA-f92v-grc2-w2fg github.com/evmos/ethermint (Go) Fixed in 0.18.0 Advisory →
- Fix · GHSA-f92v-grc2-w2fg github.com/evmos/evmos (Go) Fixed in 7.0.0 Advisory →
- Fix · GHSA-f92v-grc2-w2fg github.com/crypto-org-chain/cronos (Go) Fixed in 0.7.1-rc2 Advisory →
- Fix · GHSA-f92v-grc2-w2fg github.com/Kava-Labs/kava (Go) Fixed in 0.18.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-35936
- 2026-10-03 Alias added: GHSA-f92v-grc2-w2fg
References
Advisory 2
Sources
- CVE-2022-35936 · CVE Program
- CVE-2022-35936 · NVD
- FIRST EPSS
- GHSA-f92v-grc2-w2fg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences