Read the docs
TI-2024-21745 Aliases CVE-2024-32873GHSA-pxv8-qhrh-jc7v

evmos allows transferring unvested tokens after delegations

Priority LOW 20CWE-682Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. The spendable balance is not updated properly when delegating vested tokens. The issue allows a clawback vesting account to anticipate the release of unvested tokens. This vulnerability is fixed in 18.0.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00384 32nd percentileScored 2026-11-07
Fix Fixed evmos (evmos): 18.0.0github.com/evmos/evmos/v17 (Go): 18.0.0+11 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
evmosevmosbefore 18.0.018.0.0Patch availableCNA
—github.com/evmos/evmos/v17 (Go)before 18.0.018.0.0Patch availableGHSA-pxv8-qhrh-jc7v
—github.com/evmos/evmos/v16 (Go)before 18.0.018.0.0Patch availableGHSA-pxv8-qhrh-jc7v
—github.com/evmos/evmos/v15 (Go)before 18.0.018.0.0Patch availableGHSA-pxv8-qhrh-jc7v
—github.com/evmos/evmos/v14 (Go)before 18.0.018.0.0Patch availableGHSA-pxv8-qhrh-jc7v
—github.com/evmos/evmos/v13 (Go)before 18.0.018.0.0Patch availableGHSA-pxv8-qhrh-jc7v
—github.com/evmos/evmos/v12 (Go)before 18.0.018.0.0Patch availableGHSA-pxv8-qhrh-jc7v
—github.com/evmos/evmos/v11 (Go)before 18.0.018.0.0Patch availableGHSA-pxv8-qhrh-jc7v
—github.com/evmos/evmos/v10 (Go)before 18.0.018.0.0Patch availableGHSA-pxv8-qhrh-jc7v
—github.com/evmos/evmos/v9 (Go)before 18.0.018.0.0Patch availableGHSA-pxv8-qhrh-jc7v
—github.com/evmos/evmos/v8 (Go)before 18.0.018.0.0Patch availableGHSA-pxv8-qhrh-jc7v
—github.com/evmos/evmos/v7 (Go)before 18.0.018.0.0Patch availableGHSA-pxv8-qhrh-jc7v
—github.com/evmos/evmos/v6 (Go)before 18.0.018.0.0Patch availableGHSA-pxv8-qhrh-jc7v
  • evmos Vendorevmos Affected before 18.0.0 Fixed in 18.0.0 Patch available CNA
  • github.com/evmos/evmos/v17 (Go) Vendor— Affected before 18.0.0 Fixed in 18.0.0 Patch available GHSA-pxv8-qhrh-jc7v
  • github.com/evmos/evmos/v16 (Go) Vendor— Affected before 18.0.0 Fixed in 18.0.0 Patch available GHSA-pxv8-qhrh-jc7v
  • github.com/evmos/evmos/v15 (Go) Vendor— Affected before 18.0.0 Fixed in 18.0.0 Patch available GHSA-pxv8-qhrh-jc7v
  • github.com/evmos/evmos/v14 (Go) Vendor— Affected before 18.0.0 Fixed in 18.0.0 Patch available GHSA-pxv8-qhrh-jc7v
  • github.com/evmos/evmos/v13 (Go) Vendor— Affected before 18.0.0 Fixed in 18.0.0 Patch available GHSA-pxv8-qhrh-jc7v
  • github.com/evmos/evmos/v12 (Go) Vendor— Affected before 18.0.0 Fixed in 18.0.0 Patch available GHSA-pxv8-qhrh-jc7v
  • github.com/evmos/evmos/v11 (Go) Vendor— Affected before 18.0.0 Fixed in 18.0.0 Patch available GHSA-pxv8-qhrh-jc7v
  • github.com/evmos/evmos/v10 (Go) Vendor— Affected before 18.0.0 Fixed in 18.0.0 Patch available GHSA-pxv8-qhrh-jc7v
  • github.com/evmos/evmos/v9 (Go) Vendor— Affected before 18.0.0 Fixed in 18.0.0 Patch available GHSA-pxv8-qhrh-jc7v
  • github.com/evmos/evmos/v8 (Go) Vendor— Affected before 18.0.0 Fixed in 18.0.0 Patch available GHSA-pxv8-qhrh-jc7v
  • github.com/evmos/evmos/v7 (Go) Vendor— Affected before 18.0.0 Fixed in 18.0.0 Patch available GHSA-pxv8-qhrh-jc7v
  • github.com/evmos/evmos/v6 (Go) Vendor— Affected before 18.0.0 Fixed in 18.0.0 Patch available GHSA-pxv8-qhrh-jc7v

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:evmos:evmos:*:*:*:*:*:*:*:*before 18.0.0Vulnerableevmos
  • cpe:2.3:a:evmos:evmos:*:*:*:*:*:*:*:* Versions before 18.0.0 Vulnerable ·evmos

Remediation

  • Fix · CNA evmos (evmos) Fixed in 18.0.0
  • Fix · GHSA-pxv8-qhrh-jc7v github.com/evmos/evmos/v17 (Go) Fixed in 18.0.0 Advisory →
  • Fix · GHSA-pxv8-qhrh-jc7v github.com/evmos/evmos/v16 (Go) Fixed in 18.0.0 Advisory →
  • Fix · GHSA-pxv8-qhrh-jc7v github.com/evmos/evmos/v15 (Go) Fixed in 18.0.0 Advisory →
  • Fix · GHSA-pxv8-qhrh-jc7v github.com/evmos/evmos/v14 (Go) Fixed in 18.0.0 Advisory →
  • Fix · GHSA-pxv8-qhrh-jc7v github.com/evmos/evmos/v13 (Go) Fixed in 18.0.0 Advisory →
  • Fix · GHSA-pxv8-qhrh-jc7v github.com/evmos/evmos/v12 (Go) Fixed in 18.0.0 Advisory →
  • Fix · GHSA-pxv8-qhrh-jc7v github.com/evmos/evmos/v11 (Go) Fixed in 18.0.0 Advisory →
  • Fix · GHSA-pxv8-qhrh-jc7v github.com/evmos/evmos/v10 (Go) Fixed in 18.0.0 Advisory →
  • Fix · GHSA-pxv8-qhrh-jc7v github.com/evmos/evmos/v9 (Go) Fixed in 18.0.0 Advisory →
  • Fix · GHSA-pxv8-qhrh-jc7v github.com/evmos/evmos/v8 (Go) Fixed in 18.0.0 Advisory →
  • Fix · GHSA-pxv8-qhrh-jc7v github.com/evmos/evmos/v7 (Go) Fixed in 18.0.0 Advisory →
  • Fix · GHSA-pxv8-qhrh-jc7v github.com/evmos/evmos/v6 (Go) Fixed in 18.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-32873
  2. 2026-10-03 Alias added: GHSA-pxv8-qhrh-jc7v

References

Patch 1

Advisory 4

Other 2

  • TI-2022-16363 Ethermint DoS through Unintended Contract Selfdestruct CVSS 3.1HIGH 8.2
  • TI-2024-24680 Evmos's contract balance not updating correctly after interchain transaction CVSS 3.1HIGH 7.5
  • TI-2024-21526 Evmos' transaction execution not accounting for all state transition after interaction with precompiles CVSS 3.1CRITICAL 9.1
  • TI-2024-26619 Evmos vulnerable to exploit of smart contract account and vesting CVSS 3.1HIGH 8.8
  • TI-2022-08552 Account compromise in Evmos CVSS 3.1HIGH 8.1
  • TI-2024-24685 Evmos is missing precompile checks CVSS 3.1HIGH 8.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences