{"id":"GHSA-7225-m954-23v7","summary":"ASA-2024-010: cosmossdk.io/math: Mismatched bit-length validation in sdk.Int and sdk.Dec can lead to panic","details":"Name: ASA-2024-010: Mismatched bit-length in `sdk.Int` and `sdk.Dec` can lead to panic \nComponent: Cosmos SDK / Math\nCriticality: High (Considerable Impact, and Possible Likelihood per [ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md))\nAffected versions: `cosmossdk.io/math` package versions \u003c= `math/v1.3.0`\nAffected users: Chain Builders + Maintainers, Validators\n\n### Impact\n\nThe bit-length in `sdk.Int` and `sdk.Dec` are not aligned, which may present a possible panic condition when interacting with `Dec` types in an `Int` context. This issue was resolved by aligning the max size between the data types in the cosmossdk.io/math package.\n\nThis issue impacts consumers of the cosmossdk.io/math, which includes popular modules including IBC-Go and tokenfactory (permissionless). If your chain interacts with APIs in the cosmossdk.io/math package, or utilizes a module that consumes this library, it is advised to update to the latest version at the time of the patch release by updating your project's go.mod dependency for cosmossdk.io/math.\n\nThe patch can be applied without a hard-fork, and with a version bump in a chain's go.mod file like the following:\n\n#### `go.mod`\n\n```diff\n- cosmossdk.io/math v1.3.0\n+ cosmossdk.io/math v1.4.0\n```\n\n\u003e [!NOTE]  \n\u003e When on a lower version than cosmossdk.io/math v1.3.0, please do a coordinated upgrade before upgrading to \u003e= 1.3.0\n\n### Patches\n\nThe new release of `cosmossdk.io/math v1.4.0` resolves this issue.  Chains that utilize the cosmossdk.io/math library or modules that utilize the cosmossdk.io/math library should update to avoid this condition.\n\n### Timeline\n\n* October 31, 2024, 6:55pm UTC: Issue reported to the Cosmos Bug Bounty program\n* October 31, 2024, 8:56pm UTC: Issue triaged by Amulet on-call, and distributed to Core team\n* Nov 15, 2024, 2:12am PST: Core team completes patch for issue\n* Nov 19, 2024, 8:00am PST / 16:00 GMT: Pre-notification delivered\n* Nov 20, 2024, 8:00am PST / 16:00 GMT: Patch made available\n\n\nThis issue was reported by LonelySloth to the Cosmos Bug Bounty Program on HackerOne on October 31, 2024. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.\n\nIf you have questions about Interchain security efforts, please reach out to our official communication channel at [security@interchain.io](mailto:security@interchain.io).  For more information about the Interchain Foundation’s engagement with Amulet, and to sign up for security notification emails, please see https://github.com/interchainio/security.  \n\n","aliases":["GO-2024-3279"],"modified":"2024-11-22T20:48:48Z","published":"2024-11-20T18:23:51Z","database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-190"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2024-11-20T18:23:51Z"},"references":[{"type":"WEB","url":"https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-7225-m954-23v7"},{"type":"WEB","url":"https://github.com/cosmos/cosmos-sdk/commit/c6522a72a45c34897f9fc85d438c0b74d52f8862"},{"type":"PACKAGE","url":"https://github.com/cosmos/cosmos-sdk"},{"type":"WEB","url":"https://pkg.go.dev/vuln/GO-2024-3279"}],"affected":[{"package":{"name":"cosmossdk.io/math","ecosystem":"Go","purl":"pkg:golang/cosmossdk.io/math"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.0"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 1.3.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-7225-m954-23v7/GHSA-7225-m954-23v7.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}