CVE-2024-37154

Executive Summary

CVE-2024-37154 is a vulnerability in the Evmos blockchain, the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. The flaw allows users to delegate tokens that have not yet been vested, specifically affecting funds managed via the ClawbackVestingAccount module. This impacts employees and grantees who have tokens subject to vesting schedules and clawback provisions. The vulnerability exists in Evmos version 18.1.0 and earlier. The CVSS score is 5.3 (Medium), indicating a moderate severity due to the potential for unauthorized token delegation, which could lead to governance manipulation or economic attacks. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is specific to the Evmos blockchain software, which is built using the Cosmos SDK and Go. The affected component is the ClawbackVestingAccount module, which is part of the Evmos codebase. There is no direct NPM, PyPI, or Ruby package involved, but the Go module github.com/evmos/evmos is the affected package. Users should monitor the official Evmos repository for patches and updates.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network (AV:N) - The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) - No special conditions are required.
• Privileges Required: None (PR:N) - No authentication needed.
• User Interaction: None (UI:N) - No user action required.
• Scope: Unchanged (S:U) - The impact is confined to the vulnerable component.
• Confidentiality Impact: None (C:N) - No data exposure.
• Integrity Impact: Low (I:L) - Unauthorized delegation of tokens can affect governance and token economics.
• Availability Impact: None (A:N) - No denial of service.

Threat Level: Medium. The vulnerability allows unauthorized delegation of unvested tokens, which could be used to manipulate governance votes or gain economic advantage. However, no public exploit exists, and the impact is limited to integrity.

Deep Dive & Mechanics

The vulnerability resides in the ClawbackVestingAccount module of Evmos. This module is designed to manage tokens that are subject to vesting schedules and clawback provisions, typically used for employee grants and incentives. The intended behavior is that tokens should only be delegatable after they have vested. However, due to a missing or insufficient access control check, users can delegate tokens that are still in the vesting period.

Technical Details:

• The ClawbackVestingAccount stores tokens with a vesting schedule and a clawback address (the original funder).
• The Delegate function in the staking module should check if the tokens are vested before allowing delegation.
• The vulnerability likely stems from the Delegate function not properly verifying the vesting status of tokens in a ClawbackVestingAccount.
• This allows an attacker (or a malicious insider) to delegate unvested tokens, potentially influencing governance proposals or earning staking rewards on tokens that should not be available.

Impact:

• Governance Manipulation: Attackers can use unvested tokens to vote on governance proposals, potentially passing malicious proposals.
• Economic Exploitation: Attackers can earn staking rewards on tokens that are not yet theirs, creating an unfair advantage.
• Reputation Damage: The vulnerability undermines the trust in the vesting mechanism, affecting employee and grantee confidence.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on the vulnerability description.

Vulnerable Code (Conceptual):

// In the staking module's Delegate function
func (k Keeper) Delegate(ctx sdk.Context, delAddr sdk.AccAddress, bondAmt sdk.Int) error {
    // Missing check for vesting status
    // Directly delegates tokens without verifying if they are vested
    return k.bankKeeper.DelegateCoins(ctx, delAddr, bondAmt)
}

Patched Code (Conceptual):

// In the staking module's Delegate function
func (k Keeper) Delegate(ctx sdk.Context, delAddr sdk.AccAddress, bondAmt sdk.Int) error {
    // Check if the account is a ClawbackVestingAccount
    acc := k.accountKeeper.GetAccount(ctx, delAddr)
    if clawbackAcc, ok := acc.(*ClawbackVestingAccount); ok {
        // Verify that the tokens to be delegated are vested
        vested := clawbackAcc.GetVestedCoins(ctx.BlockTime())
        if bondAmt.GT(vested) {
            return sdkerrors.Wrap(sdkerrors.ErrUnauthorized, "cannot delegate unvested tokens")
        }
    }
    return k.bankKeeper.DelegateCoins(ctx, delAddr, bondAmt)
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to an Evmos node (version <= 18.1.0) with a ClawbackVestingAccount that has unvested tokens.
• The attacker must have the private key of the account with unvested tokens.

Steps:

1. Identify Target: Find an Evmos node running a vulnerable version. Use Shodan dorks: "Evmos node" or "Cosmos SDK ClawbackVestingAccount".
2. Connect to Node: Use the Evmos CLI or a Cosmos SDK client to connect to the node.
3. Check Account: Verify the account has a ClawbackVestingAccount with unvested tokens.

   evmosd query auth account <address>
   

4. Delegate Unvested Tokens: Execute a delegate transaction with an amount greater than the vested tokens.

   evmosd tx staking delegate <validator_address> <amount> --from <key_name> --chain-id <chain_id>
   

5. Verify Delegation: Check that the delegation was successful.

   evmosd query staking delegation <delegator_address> <validator_address>
   

Expected Outcome: The delegation succeeds, and the attacker gains voting power and staking rewards on unvested tokens.

Blue Team (Detection & Defense)

Detection:

• Monitor for delegate transactions from accounts with ClawbackVestingAccount type.
• Alert on any delegation where the amount exceeds the vested balance.
• Use the detection rules provided in the Detection Engineering section.

Defense:

• Apply the patch as soon as it is released.
• Temporarily disable delegation for ClawbackVestingAccount accounts until a patch is applied.
• Monitor governance proposals for unusual voting patterns.

Indicators of Compromise (IOCs)

• On-Chain IOCs:
  • Delegate transactions from ClawbackVestingAccount addresses with amounts exceeding vested tokens.
  • Unusual increase in voting power from accounts that should have locked tokens.
• Network IOCs:
  • Connections to Evmos nodes from IPs associated with known threat actors.
• Log IOCs:
  • Logs showing successful delegation of unvested tokens.
  • Error logs if the vulnerability is partially mitigated.

Detection Engineering

YARA Rule

rule Detect_Evmos_Unvested_Delegation {
    meta:
        description = "Detects delegate transactions from ClawbackVestingAccount with unvested tokens"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-37154"
    strings:
        $delegate = "delegate" ascii wide nocase
        $clawback = "ClawbackVestingAccount" ascii wide nocase
        $unvested = "unvested" ascii wide nocase
    condition:
        $delegate and $clawback and $unvested
}

Sigma Rule

title: Evmos Unvested Token Delegation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects delegate transactions from ClawbackVestingAccount with unvested tokens
author: Valters IT
date: 2024/10/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-37154
logsource:
    product: evmos
    service: blockchain
detection:
    selection:
        EventID: 'delegate'
        AccountType: 'ClawbackVestingAccount'
        Amount: '> vested'
    condition: selection
falsepositives:
    - Legitimate delegation of vested tokens
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 26656 (msg:"CVE-2024-37154 Evmos Unvested Token Delegation"; flow:to_server; content:"delegate"; content:"ClawbackVestingAccount"; content:"unvested"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Evmos: Upgrade to a patched version once available. Monitor the official Evmos GitHub repository for updates.
2. Disable Delegation: Temporarily disable delegation for ClawbackVestingAccount accounts using a governance proposal or node configuration.
3. Audit Accounts: Review all ClawbackVestingAccount addresses for any unauthorized delegations.

Long-Term Fixes:

• Apply the official patch from the Evmos team.
• Implement additional checks in the staking module to prevent delegation of unvested tokens.
• Conduct a security audit of the vesting module.

Workarounds:

• Use a custom fork of Evmos with the vulnerability patched.
• Implement a monitoring system to detect and alert on suspicious delegation activities.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert