On August 28 local time, Cosmos Labs published an official post-mortem covering a vulnerability in Cosmos EVM, which is used by several Cosmos-based chains, and the course of the attack. The attack took place from August 20 to August 25 UTC across six chains. Of the stolen assets, the attacker is estimated to have disposed of roughly $2.87 million worth on decentralized exchanges and roughly $2.85 million worth on centralized exchanges. The related centralized exchange accounts have been frozen for the investigation, but whether the stolen assets have actually been recovered has not been confirmed. The problem arose because Cosmos EVM and the Cosmos staking system each calculated the balance of "vesting accounts," which hold tokens that have not yet been unlocked, differently. When more tokens were staked than the available balance, the balance did not fall below zero but instead turned into a very large number. The attacker sent this balance to another account holding a large balance, triggered the same error there, and then took the tokens that account held. The vulnerability was first reported through a bug bounty on April 25. However, the test cases in the report had been written for networks with 6 decimal places, and Cosmos Labs was unable to reproduce the problem in an 18 decimal place environment. It therefore concluded that funds on live networks were not at risk, but in fact all Cosmos EVM chains were confirmed to be affected regardless of the number of decimal places. The vulnerability was fixed in v0.6.2 and v0.7.2. Cosmos Labs advised that configuration changes alone cannot fully prevent the problem, and that chains unable to upgrade immediately should halt their networks to block the attack. This disclosure is an account of the vulnerability's cause and the course of the response; it does not mean that the stolen assets have been recovered or that patching is complete across all chains.
Cosmos EVM Vulnerability Causes $5.7 Million in Losses Across Six Chains: April Report Misjudged as Posing "No Risk to Production Networks"
Metanomia View
Shared code can spread the same defect across multiple ledgers at once, even when each chain is operated independently. In this case the authority to halt a chain rested with each operating entity, but assessment of the vulnerability and information about the patch were concentrated at Cosmos Labs. When domestic institutions adopt shared blockchain software, they need to settle in advance not only code audits but also emergency contact channels, criteria for halting a network, and who has the authority to approve patches and upgrades.