CVE-2024-37153

Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. There is an issue with how to liquid stake using Safe which itself is a contract. The bug only appears when there is a local state change together with an ICS20 transfer in the same function and uses the contract's balance, that is using the contract address as the sender parameter in an ICS20 transfer using the ICS20 precompile. This is in essence the "infinite money glitch" allowing contracts to double the supply of Evmos after each transaction.The issue has been patched in versions >=V18.1.0.

• CWE-670
• CWE-670

• https://github.com/evmos/evmos/commit/478b7a62e7af57a70cf3a01126c7f5a89bee69d7Patch
• https://github.com/evmos/evmos/security/advisories/GHSA-xgr7-jgq3-mhmcExploit, Vendor Advisory
• https://github.com/evmos/evmos/commit/478b7a62e7af57a70cf3a01126c7f5a89bee69d7Patch
• https://github.com/evmos/evmos/security/advisories/GHSA-xgr7-jgq3-mhmcExploit, Vendor Advisory

Published

Jun 6, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-37148GLPI is an open-source asset and IT management software pack…8.1
• CVE-2024-37149GLPI is an open-source asset and IT management software pack…8.8
• CVE-2024-3715The Database for Contact Form 7, WPforms, Elementor forms pl…7.2
• CVE-2024-37150An issue in `.npmrc` support in Deno 1.44.0 was discovered w…6.5
• CVE-2024-37151Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2024-37152Argo CD is a declarative, GitOps continuous delivery tool fo…7.5
• CVE-2024-37154Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmo…5.3
• CVE-2024-37155OpenCTI is an open source platform allowing organizations to…8.2
• CVE-2024-37156The SuluFormBundle adds support for creating dynamic forms i…6.1
• CVE-2024-37157Discourse is an open-source discussion platform. Prior to ve…5.3
• CVE-2024-37158Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmo…8.1
• CVE-2024-37159Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmo…6.5