CVE-2024-37158

Executive Summary

CVE-2024-37158 is a medium-severity vulnerability in Evmos, the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. The flaw resides in the inconsistent implementation of ante handler checks between Cosmos and Ethereum transaction paths. A clawback vesting account can bypass Cosmos-specific security checks by submitting an Ethereum transaction that targets a precompile used to interact with a Cosmos SDK module. This allows an attacker to circumvent intended restrictions on clawback actions. The vulnerability is fixed in Evmos v18.0.0.

Supply Chain & Package Security

Evmos is a Go-based blockchain application. The vulnerability is in the core application logic, not in a package dependency. However, users should verify the integrity of their Evmos binary by checking the official release checksums and signatures from the Evmos GitHub repository.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (attacker must control a clawback vesting account)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (bypass of vesting restrictions)
• Availability Impact: None
• Threat Level: Low. Exploitation requires a specific account type and only allows bypass of vesting checks, not full system compromise.

Deep Dive & Mechanics

Evmos implements two separate ante handlers: one for Cosmos SDK transactions and one for Ethereum transactions. The ante handler is a middleware that performs preliminary checks before a transaction is processed. For clawback vesting accounts, these checks are meant to prevent unauthorized actions (e.g., transferring vested tokens before the vesting period ends).

The vulnerability arises because the Ethereum ante handler does not enforce the same checks as the Cosmos ante handler. An attacker with a clawback vesting account can craft an Ethereum transaction that calls a precompile (a built-in smart contract) that interacts with a Cosmos SDK module. Since the Ethereum ante handler does not validate the clawback restrictions, the transaction bypasses the intended security controls.

The root cause is a logic inconsistency (CWE-754: Improper Check for Unusual or Exceptional Conditions). The fix in v18.0.0 harmonizes the ante handler logic, ensuring that both transaction paths enforce the same clawback vesting checks.

Vulnerable vs. Patched Code

The vulnerable code is in the ante handler implementations. The exact code is not publicly disclosed, but the fix involves adding the same clawback vesting checks to the Ethereum ante handler that exist in the Cosmos ante handler.

Vulnerable (pseudo-code):

// Cosmos ante handler
func AnteHandlerCosmos(ctx Context, tx Tx) error {
    if isClawbackAccount(tx.Sender) {
        if !checkClawbackRestrictions(tx) {
            return ErrUnauthorized
        }
    }
    return next(ctx, tx)
}

// Ethereum ante handler (missing clawback check)
func AnteHandlerEthereum(ctx Context, tx Tx) error {
    // No clawback check here
    return next(ctx, tx)
}

Patched (pseudo-code):

// Both handlers now call a common validation function
func AnteHandlerCosmos(ctx Context, tx Tx) error {
    if err := validateClawback(tx); err != nil {
        return err
    }
    return next(ctx, tx)
}

func AnteHandlerEthereum(ctx Context, tx Tx) error {
    if err := validateClawback(tx); err != nil {
        return err
    }
    return next(ctx, tx)
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a clawback vesting account on a vulnerable Evmos node (v < 18.0.0).
• Ability to send Ethereum transactions.

Exploitation Steps:

1. Identify a clawback vesting account address.
2. Craft an Ethereum transaction that calls a precompile (e.g., the x/vesting module precompile) to perform a restricted action (e.g., transfer vested tokens).
3. Submit the transaction to the Evmos network.
4. The Ethereum ante handler will not enforce clawback restrictions, allowing the transaction to succeed.

Example (conceptual):

# Using web3.py
from web3 import Web3

w3 = Web3(Web3.HTTPProvider('http://vulnerable-node:8545'))
account = w3.eth.account.from_key('private_key')
precompile_address = '0x0000000000000000000000000000000000001000'  # Example precompile

tx = {
    'from': account.address,
    'to': precompile_address,
    'data': '0x...',  # Encoded function call to bypass vesting
    'gas': 200000,
    'gasPrice': w3.eth.gas_price,
    'nonce': w3.eth.get_transaction_count(account.address),
}
signed_tx = account.sign_transaction(tx)
tx_hash = w3.eth.send_raw_transaction(signed_tx.rawTransaction)

Blue Team

Detection:

• Monitor for Ethereum transactions from clawback vesting accounts that interact with Cosmos SDK precompiles.
• Alert on any transaction that attempts to transfer tokens from a clawback account before the vesting period ends.

Hunting:

• Query the blockchain for all Ethereum transactions sent by clawback vesting accounts.
• Analyze the to field for known precompile addresses (e.g., 0x0000000000000000000000000000000000001000 to 0x000000000000000000000000000000000000100F).

Indicators of Compromise (IOCs)

• Transaction Hashes: Any Ethereum transaction from a clawback vesting account that successfully bypasses vesting restrictions.
• Account Addresses: Clawback vesting accounts that have sent Ethereum transactions to precompiles.
• Precompile Addresses: 0x0000000000000000000000000000000000001000 - 0x000000000000000000000000000000000000100F (range for Cosmos SDK precompiles).

Detection Engineering

YARA Rule

rule CVE_2024_37158_Evmos_Clawback_Bypass {
    meta:
        description = "Detects Evmos transactions attempting to bypass clawback vesting checks via Ethereum precompiles"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-37158"
    strings:
        $precompile_call = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 0[0-9] }  // Matches precompile addresses 0x1000-0x100F
        $clawback_account = "clawback" nocase
    condition:
        $precompile_call and $clawback_account
}

Sigma Rule

title: Evmos Clawback Vesting Bypass via Ethereum Precompile
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects Ethereum transactions from clawback vesting accounts targeting Cosmos SDK precompiles
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-37158
logsource:
    category: blockchain
    product: evmos
detection:
    selection:
        tx_type: "ethereum"
        from_account_type: "clawback_vesting"
        to_address|startswith: "0x000000000000000000000000000000000000100"
    condition: selection
falsepositives:
    - Legitimate use of precompiles by non-clawback accounts
level: medium

Suricata Rule

alert ip any any -> any any (msg:"CVE-2024-37158 Evmos Clawback Vesting Bypass"; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 0|"; offset:0; depth:20; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to Evmos v18.0.0 or later.
2. Workaround: If upgrade is not possible, disable the Ethereum precompile for the vesting module or restrict access to clawback accounts via a custom firewall rule on the node.
3. Long-term: Implement consistent security checks across all transaction paths in the codebase. Conduct a thorough audit of ante handler logic for all account types.

Valters IT
Securing the decentralized future.