---
title: "GHSA-33cr-m232-xqch: cheqd-node affected by Non-deterministic JSON Unmarshalling of IBC Acknowledgement"
url: https://erroneo.us/security/ghsa/GHSA-33cr-m232-xqch/
description: "GHSA-33cr-m232-xqch (critical, Go): cheqd-node affected by Non-deterministic JSON Unmarshalling of IBC Acknowledgement. Description An issue was discovered…"
type: advisory
section: "Security Digest"
date_published: 2025-03-11
date_modified: 2025-03-14
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-33cr-m232-xqch"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-33cr-m232-xqch: cheqd-node affected by Non-deterministic JSON Unmarshalling of IBC Acknowledgement

## Affected packages

- Go `github.com/cheqd/cheqd-node` < 3.1.7 → fixed: 3.1.7

## Details

Description An issue was discovered in IBC-Go's deserialization of acknowledgements that results in non-deterministic behavior which can halt a chain. Any user that can open an IBC channel can introduce this state to the chain. This an upstream dependency used in cheqd-node, rather than a custom module. Impact Could result in a chain halt. Patches Validators, full nodes, and IBC relayers should upgrade to cheqd-node v3.1.7. This upgrade does not require a software upgrade proposal on-chain and is meant to be non state-breaking. References See ASA-2025-004: Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt upstream on IBC-Go.

## Sources

- [GitHub Advisory GHSA-33cr-m232-xqch](https://github.com/advisories/GHSA-33cr-m232-xqch)
- [github.com](https://github.com/cheqd/cheqd-node/security/advisories/GHSA-33cr-m232-xqch)
- [github.com](https://github.com/cosmos/ibc-go/security/advisories/GHSA-jg6f-48ff-5xrw)
- [github.com](https://github.com/cosmos/ibc-go/commit/59987d52d959dc5876ffd4f307c9b33a52a43748)
- [pkg.go.dev](https://pkg.go.dev/vuln/GO-2025-3514)

---
Source page: https://erroneo.us/security/ghsa/GHSA-33cr-m232-xqch/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt