Security Digest · Critical advisory (no CVE assigned)
GHSA-j496-crgh-34mx: ibc-go: Potential Reentrancy using Timeout Callbacks in ibc-hooks
Name: ASA-2024-007: Potential Reentrancy using Timeout Callbacks in ibc-hooks Component: ibc-go Criticality: Critical (ACMv1: I:Critical; L:AlmostCertain) Affected versions:
CVSS 9.1 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
govulncheck ./.... - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Go | github.com/cosmos/ibc-go/v4 | < 4.6.0 | 4.6.0 |
| Go | github.com/cosmos/ibc-go/v5 | < 5.4.0 | 5.4.0 |
| Go | github.com/cosmos/ibc-go/v6 | < 6.3.0 | 6.3.0 |
| Go | github.com/cosmos/ibc-go/v7 | < 7.4.0 | 7.4.0 |
| Go | github.com/cosmos/ibc-go/v8 | < 8.2.0 | 8.2.0 |
| Go | github.com/cosmos/ibc-go/v3 | < 4.6.0 | none listed |
| Go | github.com/cosmos/ibc-go/v2 | < 4.6.0 | none listed |
| Go | github.com/cosmos/ibc-go | < 4.6.0 | none listed |
Details
Name: ASA-2024-007: Potential Reentrancy using Timeout Callbacks in ibc-hooks Component: ibc-go Criticality: Critical (ACMv1: I:Critical; L:AlmostCertain) Affected versions:
Summary
Through the deployment and subsequent use of a malicious CosmWasm contract via IBC interactions, an attacker could potentially execute the same MsgTimeout inside the IBC hook for the OnTimeout callback before the packet commitment is deleted. On chains where ibc-hooks wraps ICS-20, this vulnerability may allow for the logic of the OnTimeout callback of the transfer application to be recursively executed, leading to a condition that may present the opportunity for the loss of funds from the escrow account or unexpected minting of tokens.
Affected Configurations
Chains which satisfy all of the following requirements are considered to be impacted by this vulnerability: Chain is IBC-enabled and uses a vulnerable version of ibc-go Chain is CosmWasm-enabled and allows code uploads for wasm contracts by anyone, or by authorized parties (to a lesser extent) Chain utilizes the ibc-hooks middleware and wraps ICS-20 transfer application
Next Steps for Impacted Chain Builders and Maintainers
It is advised to immediately upgrade to the latest patch fix version of ibc-go for your chain. If you have already applied a soft-patch through private coordination, we recommend additionally updating to the latest ibc-go version via normal software upgrade governance.
If you have not upgraded your chain yet, and you desire to mitigate exposure to this vulnerability in the meantime, it is advisable to limit code uploading for contracts to trusted parties on your chain.
CVSS: 9.1 (v3.1) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Sources and references
- GitHub Advisory GHSA-j496-crgh-34mx github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com