CVE-2024-32644
Evmos is a scalable, high-throughput Proof-of-Stake EVM blockchain that is fully compatible and interoperable with Ethereum. Prior to 17.0.0, there is a way to mint arbitrary tokens due to the possibility to have two different states not in sync during the execution of a transaction. The exploit is based on the fact that to sync the Cosmos SDK state and the EVM one, we rely on the `stateDB.Commit()` method. When we call this method, we iterate though all the `dirtyStorage` and, **if and only if** it is different than the `originStorage`, we set the new state. Setting the new state means we update the Cosmos SDK KVStore. If a contract storage state that is the same before and after a transaction, but is changed during the transaction and can call an external contract after the change, it can be exploited to make the transaction similar to non-atomic. The vulnerability is **critical** since this could lead to drain of funds through creative SC interactions. The issue has been patched in versions >=V17.0.0.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- EPSS probability
- 0.94%
- CWE
- CWE-662
- Published
- 2024-04-19
- Last modified
- 2026-03-13
Affected products
- evmos evmos
Weakness type
Related vulnerabilities
- CVE-2026-13489 — 78 xiaozhi-esp32 MCP Response mcp_server.cc ParseMessage improper synchronization
- CVE-2026-39865 — Axios HTTP/2 Session Cleanup State Corruption Vulnerability
- CVE-2026-28789 — OliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handling
- CVE-2025-22853 — Improper synchronization in the firmware for some Intel(R) TDX may allow a privileged user to...
- CVE-2025-27104 — double eval in For List Iter in Vyper
- CVE-2024-7409 — Qemu: denial of service via improper synchronization in qemu nbd server during socket closure