Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. The spendable balance is not updated properly when delegating vested tokens. The issue allows a clawback vesting account to anticipate the release of unvested tokens. This vulnerability is fixed in 18.0.0.
Affected: Go: github.com/evmos/evmos/v17, Go: github.com/evmos/evmos/v16, Go: github.com/evmos/evmos/v15, Go: github.com/evmos/evmos/v14, Go: github.com/evmos/evmos/v13, Go: github.com/evmos/evmos/v12, Go: github.com/evmos/evmos/v11, Go: github.com/evmos/evmos/v10, Go: github.com/evmos/evmos/v9, Go: github.com/evmos/evmos/v8 and 2 more
## Impact
This advisory has been created to address the following vulnerabilities found in the Evmos codebase and affecting vesting accounts.
### Wrong spendable balance computation
The spendable balance is not updated properly when delegating vested tokens. The following example help in describing the issue: - Given a clawback vesting account with a starting `15M` vesting schedule. The initial spendable balance is `0`. - Time passes and `5M` are vested. The spendable balance is now `5M`. - The account delegate `5M`. The spendable balance should be `0`, but returns `5M` - The account can send `5M` to another account.
The issue allowed a clawback vesting account to anticipate the release of unvested tokens.
### Missing precompile checks
Preliminary checks on actions computed by the clawback vesting accounts are performed in the ante handler. Evmos core, implements two different ante handlers: one for Cosmos transactions and one for Ethereum transactions. Checks performed on the two implementation are different.
The vulnerability discovered allowed a clawback account to bypass Cosmos ante handler checks by sending an Ethereum transaction targeting a precompile used to interact with a Cosmos SDK module.
### Missing create validator check
This vulnerability allowed a user to create a validator using vested tokens to deposit the self-bond.
## Patches
- The spendable balance function has been fixed correcting the `TrackDelegation` function. - The checks for the staking…