---
title: "GHSA-54gx-3cgr-7mfm: Cosmos EVM: incorrect state handling during nested EVM execution paths"
url: https://erroneo.us/security/ghsa/GHSA-54gx-3cgr-7mfm/
description: "GHSA-54gx-3cgr-7mfm (critical, Go): Cosmos EVM: incorrect state handling during nested EVM execution paths. Advisory ID: ASA-2026-002 Component: ICS20…"
type: advisory
section: "Security Digest"
date_published: 2026-03-11
date_modified: 2026-03-11
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-54gx-3cgr-7mfm"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-54gx-3cgr-7mfm: Cosmos EVM: incorrect state handling during nested EVM execution paths

## Affected packages

- Go `github.com/cosmos/evm` < 0.6.0 → fixed: 0.6.0

## Details

Advisory ID: ASA-2026-002 Component: ICS20 Precompile Status: Resolved Published: March 2026 Contact: security@cosmoslabs.io --- Security Advisory ASA-2026-002 Status: Resolved. A patch is available and all known affected chains have either applied mitigations or upgraded. | Field | Value | | --- | --- | | Severity | Critical | | Affected Component | ICS20 Precompile | | Affected Versions | Cosmos EVM implementations including the ICS20 precompile | | Patched Version | v0.6.0 | | First Reported | January 21, 2026 | | Public Disclosure | March 2026 | --- Introduction Recently, there was a vulnerability affecting a feature used by some chains built on the Cosmos EVM stack. Working together with ecosystem partners and affected teams, particularly Saga, B-Harvest, Mantra, Zellic and Sherlock, Cosmos Labs investigated the issue, coordinated mitigations, developed a permanent fix, and issued a patch to affected chains. We appreciate the collaboration of the teams who assisted during the investigation and response process and thank our ecosystem partners for their support in coordinating mitigation and validation efforts. --- Remediation Summary On January 21, 2026, Cosmos Labs was notified of suspicious activity on a network running the affected implementation. The issue resulted in financial loss on the Saga EVM network. After confirming the vulnerability, Cosmos Labs coordinated with the affected chain team and ecosystem partners to investigate the issue, deploy mitigations, and assist other chains running the affected code. Cosmos Labs contacted chains known to be running versions containing the affected component to verify their configurations and support mitigation where necessary. At the time of publication, all known affected chains have either applied mitigations or upgraded to a patched version. --- Root Cause The vulnerability was caused by incorrect state handling during nested EVM execution paths involving the ICS20 precompile. Under certain execution conditions, state updates performed during recursive calls were not correctly reflected in the outer execution context. This could allow repeated use of the same token balance within a…

## Sources

- [GitHub Advisory GHSA-54gx-3cgr-7mfm](https://github.com/advisories/GHSA-54gx-3cgr-7mfm)
- [github.com](https://github.com/cosmos/evm/security/advisories/GHSA-54gx-3cgr-7mfm)
- [github.com](https://github.com/cosmos/evm/releases/tag/v0.6.0)

---
Source page: https://erroneo.us/security/ghsa/GHSA-54gx-3cgr-7mfm/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt