Evmos's contract balance not updating correctly after interchain transaction
Priority HIGH 72CWE-670Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. There is an issue with how to liquid stake using Safe which itself is a contract. The bug only appears when there is a local state change together with an ICS20 transfer in the same function and uses the contract's balance, that is using the contract address as the sender parameter in an ICS20 transfer using the ICS20 precompile. This is in essence the "infinite money glitch" allowing contracts to double the supply of Evmos after each transaction.The issue has been patched in versions >=V18.1.0.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00618 49th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed github.com/evmos/evmos/v18 (Go): 18.1.0github.com/evmos/evmos/v17 (Go): 18.1.0+11 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| evmos | evmos | up to 18.0.0 | — | No fix listed | CNA |
| — | github.com/evmos/evmos/v18 (Go) | before 18.1.0 | 18.1.0 | Patch available | GHSA-xgr7-jgq3-mhmc |
| — | github.com/evmos/evmos/v17 (Go) | before 18.1.0 | 18.1.0 | Patch available | GHSA-xgr7-jgq3-mhmc |
| — | github.com/evmos/evmos/v16 (Go) | before 18.1.0 | 18.1.0 | Patch available | GHSA-xgr7-jgq3-mhmc |
| — | github.com/evmos/evmos/v15 (Go) | before 18.1.0 | 18.1.0 | Patch available | GHSA-xgr7-jgq3-mhmc |
| — | github.com/evmos/evmos/v14 (Go) | before 18.1.0 | 18.1.0 | Patch available | GHSA-xgr7-jgq3-mhmc |
| — | github.com/evmos/evmos/v13 (Go) | before 18.1.0 | 18.1.0 | Patch available | GHSA-xgr7-jgq3-mhmc |
| — | github.com/evmos/evmos/v12 (Go) | before 18.1.0 | 18.1.0 | Patch available | GHSA-xgr7-jgq3-mhmc |
| — | github.com/evmos/evmos/v11 (Go) | before 18.1.0 | 18.1.0 | Patch available | GHSA-xgr7-jgq3-mhmc |
| — | github.com/evmos/evmos/v10 (Go) | before 18.1.0 | 18.1.0 | Patch available | GHSA-xgr7-jgq3-mhmc |
| — | github.com/evmos/evmos/v9 (Go) | before 18.1.0 | 18.1.0 | Patch available | GHSA-xgr7-jgq3-mhmc |
| — | github.com/evmos/evmos/v8 (Go) | before 18.1.0 | 18.1.0 | Patch available | GHSA-xgr7-jgq3-mhmc |
| — | github.com/evmos/evmos/v7 (Go) | before 18.1.0 | 18.1.0 | Patch available | GHSA-xgr7-jgq3-mhmc |
| — | github.com/evmos/evmos/v6 (Go) | before 18.1.0 | 18.1.0 | Patch available | GHSA-xgr7-jgq3-mhmc |
- evmos Vendorevmos Affected up to 18.0.0 Fixed in — No fix listed CNA
- github.com/evmos/evmos/v18 (Go) Vendor— Affected before 18.1.0 Fixed in 18.1.0 Patch available GHSA-xgr7-jgq3-mhmc
- github.com/evmos/evmos/v17 (Go) Vendor— Affected before 18.1.0 Fixed in 18.1.0 Patch available GHSA-xgr7-jgq3-mhmc
- github.com/evmos/evmos/v16 (Go) Vendor— Affected before 18.1.0 Fixed in 18.1.0 Patch available GHSA-xgr7-jgq3-mhmc
- github.com/evmos/evmos/v15 (Go) Vendor— Affected before 18.1.0 Fixed in 18.1.0 Patch available GHSA-xgr7-jgq3-mhmc
- github.com/evmos/evmos/v14 (Go) Vendor— Affected before 18.1.0 Fixed in 18.1.0 Patch available GHSA-xgr7-jgq3-mhmc
- github.com/evmos/evmos/v13 (Go) Vendor— Affected before 18.1.0 Fixed in 18.1.0 Patch available GHSA-xgr7-jgq3-mhmc
- github.com/evmos/evmos/v12 (Go) Vendor— Affected before 18.1.0 Fixed in 18.1.0 Patch available GHSA-xgr7-jgq3-mhmc
- github.com/evmos/evmos/v11 (Go) Vendor— Affected before 18.1.0 Fixed in 18.1.0 Patch available GHSA-xgr7-jgq3-mhmc
- github.com/evmos/evmos/v10 (Go) Vendor— Affected before 18.1.0 Fixed in 18.1.0 Patch available GHSA-xgr7-jgq3-mhmc
- github.com/evmos/evmos/v9 (Go) Vendor— Affected before 18.1.0 Fixed in 18.1.0 Patch available GHSA-xgr7-jgq3-mhmc
- github.com/evmos/evmos/v8 (Go) Vendor— Affected before 18.1.0 Fixed in 18.1.0 Patch available GHSA-xgr7-jgq3-mhmc
- github.com/evmos/evmos/v7 (Go) Vendor— Affected before 18.1.0 Fixed in 18.1.0 Patch available GHSA-xgr7-jgq3-mhmc
- github.com/evmos/evmos/v6 (Go) Vendor— Affected before 18.1.0 Fixed in 18.1.0 Patch available GHSA-xgr7-jgq3-mhmc
Remediation
- Fix · GHSA-xgr7-jgq3-mhmc github.com/evmos/evmos/v18 (Go) Fixed in 18.1.0 Advisory →
- Fix · GHSA-xgr7-jgq3-mhmc github.com/evmos/evmos/v17 (Go) Fixed in 18.1.0 Advisory →
- Fix · GHSA-xgr7-jgq3-mhmc github.com/evmos/evmos/v16 (Go) Fixed in 18.1.0 Advisory →
- Fix · GHSA-xgr7-jgq3-mhmc github.com/evmos/evmos/v15 (Go) Fixed in 18.1.0 Advisory →
- Fix · GHSA-xgr7-jgq3-mhmc github.com/evmos/evmos/v14 (Go) Fixed in 18.1.0 Advisory →
- Fix · GHSA-xgr7-jgq3-mhmc github.com/evmos/evmos/v13 (Go) Fixed in 18.1.0 Advisory →
- Fix · GHSA-xgr7-jgq3-mhmc github.com/evmos/evmos/v12 (Go) Fixed in 18.1.0 Advisory →
- Fix · GHSA-xgr7-jgq3-mhmc github.com/evmos/evmos/v11 (Go) Fixed in 18.1.0 Advisory →
- Fix · GHSA-xgr7-jgq3-mhmc github.com/evmos/evmos/v10 (Go) Fixed in 18.1.0 Advisory →
- Fix · GHSA-xgr7-jgq3-mhmc github.com/evmos/evmos/v9 (Go) Fixed in 18.1.0 Advisory →
- Fix · GHSA-xgr7-jgq3-mhmc github.com/evmos/evmos/v8 (Go) Fixed in 18.1.0 Advisory →
- Fix · GHSA-xgr7-jgq3-mhmc github.com/evmos/evmos/v7 (Go) Fixed in 18.1.0 Advisory →
- Fix · GHSA-xgr7-jgq3-mhmc github.com/evmos/evmos/v6 (Go) Fixed in 18.1.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-37153
- 2026-10-03 Alias added: GHSA-xgr7-jgq3-mhmc
References
More Evmos vulnerabilities
- TI-2022-16363 Ethermint DoS through Unintended Contract Selfdestruct CVSS 3.1HIGH 8.2
- TI-2024-21526 Evmos' transaction execution not accounting for all state transition after interaction with precompiles CVSS 3.1CRITICAL 9.1
- TI-2024-26619 Evmos vulnerable to exploit of smart contract account and vesting CVSS 3.1HIGH 8.8
- TI-2022-08552 Account compromise in Evmos CVSS 3.1HIGH 8.1
- TI-2024-24685 Evmos is missing precompile checks CVSS 3.1HIGH 8.1
- TI-2024-24681 Evmos allows unvested token delegations CVSS 3.1MEDIUM 5.3
Sources
- CVE-2024-37153 · CVE Program
- CVE-2024-37153 · NVD
- FIRST EPSS
- GHSA-xgr7-jgq3-mhmc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences