Read the docs
TI-2024-24681 Aliases CVE-2024-37154GHSA-7hrh-v6wp-53vw

Evmos allows unvested token delegations

Priority LOW 30CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. Users are able to delegate tokens that have not yet been vested. This affects employees and grantees who have funds managed via `ClawbackVestingAccount`. This affects 18.1.0 and earlier.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00382 32nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
evmosevmosup to 18.1.0—No fix listedCNA
—github.com/evmos/evmos/v18 (Go)up to 18.1.0—No fix listedGHSA-7hrh-v6wp-53vw
—github.com/evmos/evmos/v17 (Go)up to 17.0.1—No fix listedGHSA-7hrh-v6wp-53vw
—github.com/evmos/evmos/v16 (Go)up to 16.0.4—No fix listedGHSA-7hrh-v6wp-53vw
—github.com/evmos/evmos/v15 (Go)up to 15.0.0—No fix listedGHSA-7hrh-v6wp-53vw
—github.com/evmos/evmos/v14 (Go)up to 14.1.0—No fix listedGHSA-7hrh-v6wp-53vw
—github.com/evmos/evmos/v13 (Go)up to 13.0.2—No fix listedGHSA-7hrh-v6wp-53vw
—github.com/evmos/evmos/v12 (Go)up to 12.1.6—No fix listedGHSA-7hrh-v6wp-53vw
—github.com/evmos/evmos/v11 (Go)up to 11.0.2—No fix listedGHSA-7hrh-v6wp-53vw
—github.com/evmos/evmos/v10 (Go)up to 10.0.1—No fix listedGHSA-7hrh-v6wp-53vw
—github.com/evmos/evmos/v9 (Go)up to 9.1.0—No fix listedGHSA-7hrh-v6wp-53vw
—github.com/evmos/evmos/v8 (Go)up to 8.2.3—No fix listedGHSA-7hrh-v6wp-53vw
—github.com/evmos/evmos/v7 (Go)up to 7.0.0—No fix listedGHSA-7hrh-v6wp-53vw
—github.com/evmos/evmos/v6 (Go)up to 6.0.4—No fix listedGHSA-7hrh-v6wp-53vw
  • evmos Vendorevmos Affected up to 18.1.0 Fixed in — No fix listed CNA
  • github.com/evmos/evmos/v18 (Go) Vendor— Affected up to 18.1.0 Fixed in — No fix listed GHSA-7hrh-v6wp-53vw
  • github.com/evmos/evmos/v17 (Go) Vendor— Affected up to 17.0.1 Fixed in — No fix listed GHSA-7hrh-v6wp-53vw
  • github.com/evmos/evmos/v16 (Go) Vendor— Affected up to 16.0.4 Fixed in — No fix listed GHSA-7hrh-v6wp-53vw
  • github.com/evmos/evmos/v15 (Go) Vendor— Affected up to 15.0.0 Fixed in — No fix listed GHSA-7hrh-v6wp-53vw
  • github.com/evmos/evmos/v14 (Go) Vendor— Affected up to 14.1.0 Fixed in — No fix listed GHSA-7hrh-v6wp-53vw
  • github.com/evmos/evmos/v13 (Go) Vendor— Affected up to 13.0.2 Fixed in — No fix listed GHSA-7hrh-v6wp-53vw
  • github.com/evmos/evmos/v12 (Go) Vendor— Affected up to 12.1.6 Fixed in — No fix listed GHSA-7hrh-v6wp-53vw
  • github.com/evmos/evmos/v11 (Go) Vendor— Affected up to 11.0.2 Fixed in — No fix listed GHSA-7hrh-v6wp-53vw
  • github.com/evmos/evmos/v10 (Go) Vendor— Affected up to 10.0.1 Fixed in — No fix listed GHSA-7hrh-v6wp-53vw
  • github.com/evmos/evmos/v9 (Go) Vendor— Affected up to 9.1.0 Fixed in — No fix listed GHSA-7hrh-v6wp-53vw
  • github.com/evmos/evmos/v8 (Go) Vendor— Affected up to 8.2.3 Fixed in — No fix listed GHSA-7hrh-v6wp-53vw
  • github.com/evmos/evmos/v7 (Go) Vendor— Affected up to 7.0.0 Fixed in — No fix listed GHSA-7hrh-v6wp-53vw
  • github.com/evmos/evmos/v6 (Go) Vendor— Affected up to 6.0.4 Fixed in — No fix listed GHSA-7hrh-v6wp-53vw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:evmos:evmos:*:*:*:*:*:*:*:*all versionsVulnerableevmos
  • cpe:2.3:a:evmos:evmos:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·evmos

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-37154
  2. 2026-10-03 Alias added: GHSA-7hrh-v6wp-53vw

References

Advisory 2

Other 2

  • TI-2022-16363 Ethermint DoS through Unintended Contract Selfdestruct CVSS 3.1HIGH 8.2
  • TI-2024-24680 Evmos's contract balance not updating correctly after interchain transaction CVSS 3.1HIGH 7.5
  • TI-2024-21526 Evmos' transaction execution not accounting for all state transition after interaction with precompiles CVSS 3.1CRITICAL 9.1
  • TI-2024-26619 Evmos vulnerable to exploit of smart contract account and vesting CVSS 3.1HIGH 8.8
  • TI-2022-08552 Account compromise in Evmos CVSS 3.1HIGH 8.1
  • TI-2024-24685 Evmos is missing precompile checks CVSS 3.1HIGH 8.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences