CWA-2025-006: wasmd's improper error handling may lead to IBC channel opening despite error
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
# CWA-2025-006: Improper error handling may lead to IBC channel opening despite error **Severity** High (Considerable + Likely)[^1] **Affected versions:** - wasmd 0.60.0 - wasmd >= 0.51.0 < 0.55.1 **Patched versions:** - wasmd 0.60.1, 0.55.1, 0.54.1, 0.53.3 ## Description of the bug A contract erroring during IBC channel opening does not prevent the channel from opening. ## Applying the patch The patch will be shipped in a wasmd release. You will also have to update `libwasmvm` if you build statically. If you already use the latest / close to latest wasmd, you can update more or less as follows: 1. Check the current wasmd version: `go list -m github.com/CosmWasm/wasmd` 2. Bump the `github.com/CosmWasm/wasmd` dependency in your go.mod to 0.60.1 (Cosmos SDK 0.53 compatible), 0.55.1 (Cosmos SDK 0.50 compatible), 0.54.1 or 0.53.3; `go mod tidy`; commit. 3. If you use the static libraries `libwasmvm_muslc.aarch64.a`/`libwasmvm_muslc.x86_64.a`, make sure that you use the same version as your wasmvm version. 4. Check the updated wasmd version: `go list -m github.com/CosmWasm/wasmd` and ensure you see 0.60.1, 0.55.1, 0.54.1 or 0.53.3. 5. Follow your regular practices to deploy chain upgrades. The patch is consensus breaking. ## Acknowledgement This problem was discovered during an audit of the CosmWasm stack performed by Sherlock and funded by ICF/ICL in Q1 2025. Thank you for that work! If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see <https://hackerone.com/cosmos>. ## Timeline - 2025-03-03: Auditor informs Confio about this issue. - 2025-04-10: Confio developed the patch internally. - 2025-06-05: Upcoming patch is announced. - 2025-06-10: Patch is released. [^1]: following Amulet's Severity Classification Framework ACMv1.2: <https://github.com/interchainio/security/blob/0295254e8645301ccb606d46108a45cede0a73e0/resources/CLASSIFICATION_MATRIX.md>
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | github.com/CosmWasm/wasmd (Go) | 0.60.0 to before 0.60.1 | 0.60.1 | Patch available | GHSA-79xg-q4qm-7v9w |
| — | github.com/CosmWasm/wasmd (Go) | 0.55.0 to before 0.55.1 | 0.55.1 | Patch available | GHSA-79xg-q4qm-7v9w |
| — | github.com/CosmWasm/wasmd (Go) | 0.54.0 to before 0.54.1 | 0.54.1 | Patch available | GHSA-79xg-q4qm-7v9w |
| — | github.com/CosmWasm/wasmd (Go) | 0.51.0 to before 0.53.3 | 0.53.3 | Patch available | GHSA-79xg-q4qm-7v9w |
- github.com/CosmWasm/wasmd (Go) Vendor— Affected 0.60.0 to before 0.60.1 Fixed in 0.60.1 Patch available GHSA-79xg-q4qm-7v9w
- github.com/CosmWasm/wasmd (Go) Vendor— Affected 0.55.0 to before 0.55.1 Fixed in 0.55.1 Patch available GHSA-79xg-q4qm-7v9w
- github.com/CosmWasm/wasmd (Go) Vendor— Affected 0.54.0 to before 0.54.1 Fixed in 0.54.1 Patch available GHSA-79xg-q4qm-7v9w
- github.com/CosmWasm/wasmd (Go) Vendor— Affected 0.51.0 to before 0.53.3 Fixed in 0.53.3 Patch available GHSA-79xg-q4qm-7v9w
Remediation
- Fix · GHSA-79xg-q4qm-7v9w github.com/CosmWasm/wasmd (Go) Fixed in 0.60.1 Advisory →
- Fix · GHSA-79xg-q4qm-7v9w github.com/CosmWasm/wasmd (Go) Fixed in 0.55.1 Advisory →
- Fix · GHSA-79xg-q4qm-7v9w github.com/CosmWasm/wasmd (Go) Fixed in 0.54.1 Advisory →
- Fix · GHSA-79xg-q4qm-7v9w github.com/CosmWasm/wasmd (Go) Fixed in 0.53.3 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-79xg-q4qm-7v9w
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences