Read the docs
TI-2024-24685 Aliases CVE-2024-37158

Evmos is missing precompile checks

Priority LOW 36CWE-691Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. Preliminary checks on actions computed by the clawback vesting accounts are performed in the ante handler. Evmos core, implements two different ante handlers: one for Cosmos transactions and one for Ethereum transactions. Checks performed on the two implementation are different. The vulnerability discovered allowed a clawback account to bypass Cosmos ante handler checks by sending an Ethereum transaction targeting a precompile used to interact with a Cosmos SDK module. This vulnerability is fixed in 18.0.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0044 38th percentileScored 2026-11-07
Fix Fixed evmos (evmos): 18.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
evmosevmosbefore 18.0.018.0.0Patch availableCNA
  • evmos Vendorevmos Affected before 18.0.0 Fixed in 18.0.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:evmos:evmos:*:*:*:*:*:*:*:*before 18.0.0Vulnerableevmos
  • cpe:2.3:a:evmos:evmos:*:*:*:*:*:*:*:* Versions before 18.0.0 Vulnerable ·evmos

Remediation

  • Fix · CNA evmos (evmos) Fixed in 18.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-37158

References

Patch 1

Advisory 1

  • TI-2022-16363 Ethermint DoS through Unintended Contract Selfdestruct CVSS 3.1HIGH 8.2
  • TI-2024-24680 Evmos's contract balance not updating correctly after interchain transaction CVSS 3.1HIGH 7.5
  • TI-2024-21526 Evmos' transaction execution not accounting for all state transition after interaction with precompiles CVSS 3.1CRITICAL 9.1
  • TI-2024-26619 Evmos vulnerable to exploit of smart contract account and vesting CVSS 3.1HIGH 8.8
  • TI-2022-08552 Account compromise in Evmos CVSS 3.1HIGH 8.1
  • TI-2024-24681 Evmos allows unvested token delegations CVSS 3.1MEDIUM 5.3
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences