Skip to content

Cosmos EVM vesting-account balance overflow exploited across six chains (GHSA-7g4w-cg88-2cq2, Aug 20–25, 2026)

Tags

Summary

Cosmos Labs disclosed that a critical balance-handling flaw in the shared Cosmos EVM module — GHSA-7g4w-cg88-2cq2 — was exploited to drain funds from six blockchains between August 20 and August 25, 2026. The flaw is rated Critical, and was published without a CVE identifier, a CWE classification, or a CVSS score.

  • Affected versions: < 0.6.2 and >= 0.7.0 < 0.7.2.
  • Fixed in: v0.6.2 and v0.7.2, shipped August 19, 2026.
  • Remediation: upgrade as a coordinated, state-breaking network upgrade. Operators who cannot upgrade immediately are told to halt the chain rather than run a coordinated governance upgrade. No configuration-only mitigation exists; disabling the staking precompile removes the primary trigger path but is not a substitute for the patch.

The post-mortem (published August 28, 2026) states the flaw was reported through the bug bounty program on April 25 and initially assessed as posing no risk to funds on live networks — "We were unable to reproduce the vulnerability on 18-decimal networks and incorrectly concluded that it affected only non-18-decimal networks." Cosmos Labs confirmed by August 13 that all Cosmos EVM chains were affected regardless of decimal configuration, then routed the fix through its public silent-patch process rather than the private distribution its own policy prescribes for fund-loss threats in production.

Affected versions

Component Affected Fixed in
Cosmos EVM (github.com/cosmos/evm) < 0.6.2 v0.6.2
Cosmos EVM (github.com/cosmos/evm) >= 0.7.0 < 0.7.2 v0.7.2

Both releases shipped August 19, 2026. Both release notes state the release "contains important security fixes and should be applied as soon as possible," and both omit the security backport from their notes.

Exploitation precondition: the chain must permit permissionless vesting-account creation. Chains that restrict this are not exploitable via the primary path.

Attack mechanics

The flaw sits in the code that reconciles EVM state with the Cosmos SDK x/bank module.

  1. State model mismatch. The EVM StateDB tracks only an account's spendable balance. Vesting accounts in SDK state hold both a spendable and a locked balance, and both x/staking and the staking precompile permit the locked portion to be delegated.
  2. Unchecked subtraction. When a vesting account delegates more than its spendable balance, the post-delegation write-back subtracts the full delegated amount from the smaller spendable figure. The subtraction is unchecked, so the balance wraps to roughly 2^256.
  3. Reconciliation oracle. Reconciliation mints on a positive delta and burns on a negative one.
  4. Attacker control. The attacker can (a) move a finite amount out of the wrapped account, or (b) send a victim account 2^256 minus its balance so reconciliation burns the victim's real holdings.
  5. Two code paths, one transaction.
  6. 0.6.x chains mint/burn on the backing SDK ledger, so a large mint causes a supply overflow that halts the chain.
  7. 0.7.x chains set balances directly in x/bank and accept changes that survive a uint256 → int256 conversion.
  8. Both halves run inside a single transaction with a net supply change of zero, from a contract deployed onto a precomputed address that was first turned into a vesting account.

Payload / incident timeline

Time (UTC) Event
Apr 25, 2026 Flaw reported via bug bounty; assessed as no risk to live networks (failed to reproduce on 18-decimal networks).
May 15, 2026 SubBalance underflow guard merged to main (PR #1176).
May 20, 2026 Locked-balance snapshot merged to main (PR #1187); backports opened same day.
Aug 13, 2026 Confirmed all chains affected regardless of decimal config.
Aug 19, 2026 v0.6.2 / v0.7.2 fixes shipped (silent patch, public main branch).
Aug 20 07:16 Public PR in Push Chain's fork describes the vuln + exploit path (~8h15m after releases).
Aug 20 19:06 First attack — MANTRA (~11h50m after releases).
Aug 20–25 Exploitation across six blockchains.
Aug 21 03:36 Cosmos Labs first private secure-email notification (~2h after MANTRA reported exploitation).
Aug 21 ZetaChain (morde08) ports all three fixes; notes cherry-pick left the fork's live path unpatched (duplicate unexported helpers).
Aug 23 Warden Protocol (jlehtimaki) blocks vesting-account creation outright.
Aug 28, 2026 Post-mortem published.

Downstream port hazards (durable lesson): - A cherry-pick that patches only the exported helper can leave a duplicated unexported copy live while every test still passes. ZetaChain's August 21 port of all three fixes had this exact defect. - PR #1176 (underflow guard) and PR #1187 (locked-balance snapshot) are named nowhere in the advisory; commit 3524ebc ("Merge commit from fork") adds the module-account guard, which rejects any attempt to set the balance of a module account — an unconditional rejection that breaks EVM calls made from a module account.

Detection / response for operators

  1. Upgrade to v0.6.2 / v0.7.2+ as a coordinated network upgrade (state-breaking).
  2. Halt rather than vote if you cannot upgrade immediately.
  3. No config-only mitigation. Disabling the staking precompile removes the primary trigger but is not a substitute for the patch.
  4. Close the precondition: reject MsgCreateVestingAccount, MsgCreatePermanentLockedAccount, and MsgCreatePeriodicVestingAccount in the ante handler. Genesis-defined vesting accounts are unaffected.
  5. Verify the live code path on a fork — a cherry-pick of the exported helper can leave a duplicated unexported copy unpatched while tests pass.
  6. Apply the two fixes the advisory omits (PR #1187 locked-balance snapshot + commit 3524ebc module-account guard).
  7. Register a security contact with Cosmos Labs — the incident exposed eleven Cosmos EVM deployments that had never registered with its security channels.

Why this matters

  • Shared-module supply chain at the consensus layer. One upstream flaw in a single shared EVM module silently exposed every chain that composes it — a cross-chain blast-radius primitive distinct from, but isomorphic to, the package-manager supply-chain attacks on this site (see the Shai-Hulud / TeamPCP entries). The "shared dependency" is here a state-mutating consensus module, not an npm/PyPI crate.
  • Process failure, not just code failure. The advisory's own root cause: a mis-triaged bug-bounty submission (decimal-assumption false negative) plus routing a known fund-loss threat through the public silent-patch process instead of the private distribution its policy mandates. Cosmos Labs concedes this violated its own July 27-published bug-bounty policy.
  • Advisory incompleteness is an operational hazard. Two of the three required fixes are absent from the advisory text, and the advisory's single documented change was backported ~90 days after an equally state-breaking change — operators relying only on the advisory will under-patch.
  • Detection shape: anomalous x/bank balance writes to a vesting account that delegate above spendable balance; a wrapped ≈2^256 account followed by a large burn; a single-transaction net-zero-supply drain from a contract at a precomputed address previously converted to a vesting account.

Sources

  • The Hacker News — "Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable" (Swati Khandelwal, August 28, 2026): https://thehackernews.com/2026/08/cosmos-evm-flaw-exploited-after-cosmos.html
  • Cosmos Labs post-mortem (published August 28, 2026), as summarized in the THN report.
  • GitHub advisory GHSA-7g4w-cg88-2cq2 (Critical; no CVE / CVSS / CWE) and releases v0.6.2 / v0.7.2 (github.com/cosmos/evm).

Note: GHSA-7g4w-cg88-2cq2 was not yet resolvable in the GitHub global advisory DB at scan time (404); details above are corroborated from the THN report and the cited Cosmos post-mortem. Re-verify the canonical advisory URL when it becomes publicly indexed.