CVE-2024-37158

Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. Preliminary checks on actions computed by the clawback vesting accounts are performed in the ante handler. Evmos core, implements two different ante handlers: one for Cosmos transactions and one for Ethereum transactions. Checks performed on the two implementation are different. The vulnerability discovered allowed a clawback account to bypass Cosmos ante handler checks by sending an Ethereum transaction targeting a precompile used to interact with a Cosmos SDK module. This vulnerability is fixed in 18.0.0.

• CWE-691

• https://github.com/evmos/evmos/commit/b2a09ca66613d8b04decd3f2dcba8e1e77709dcbPatch
• https://github.com/evmos/evmos/security/advisories/GHSA-pxv8-qhrh-jc7vVendor Advisory
• https://github.com/evmos/evmos/commit/b2a09ca66613d8b04decd3f2dcba8e1e77709dcbPatch
• https://github.com/evmos/evmos/security/advisories/GHSA-pxv8-qhrh-jc7vVendor Advisory

Published

Jun 17, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-37152Argo CD is a declarative, GitOps continuous delivery tool fo…7.5
• CVE-2024-37153Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmo…7.5
• CVE-2024-37154Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmo…5.3
• CVE-2024-37155OpenCTI is an open source platform allowing organizations to…8.2
• CVE-2024-37156The SuluFormBundle adds support for creating dynamic forms i…6.1
• CVE-2024-37157Discourse is an open-source discussion platform. Prior to ve…5.3
• CVE-2024-37159Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmo…6.5
• CVE-2024-3716A flaw was found in foreman-installer when puppet-candlepin …6.2
• CVE-2024-37160Formwork is a flat file-based Content Management System (CMS…4.8
• CVE-2024-37161MeterSphere is an open source continuous testing platform. P…6.1
• CVE-2024-37162zsa is a library for building typesafe server actions in Nex…5.3
• CVE-2024-37163SkyScrape is a GUI Dashboard for AWS Infrastructure and Mana…7.5