Cosmos Fixes 'Critical' IBC Protocol Flaw, Protects $126M

2024/04/24 03:32

A blockchain security firm that had privately disclosed the issue to Cosmos said the developers of Cosmos have fixed a "critical" security bug in their Inter-Blockchain Communication (IBC) protocol that was putting at least $126 million at risk.

"The vulnerability was privately disclosed through the Cosmos HackerOne Bug Bounty program, and the issue is now patched," added the Asymmetric Research team.

"No malicious exploitation took place, and no funds were lost," it added.

This bug could have led to a reentrancy attack that would allow a hacker to mint an infinite amount of tokens on IBC-connected chains, such as Osmosis and others within the decentralized financial ecosystem of Cosmos. "On Osmosis, the rate limiting would slow down the damage. We believe that at least $126M+ in assets could be stolen on Osmosis. However, the rate limiting on Osmosis is slowing down the damage which can be caused.".

Rate limits are meant to a cold water, or at least mitigate, on any attacks trying to flood a system by regulating the speed with which requests may be made.

Sponsored Business Content

Asymmetric has been notified of this bug, which has been a part of ibc-go since the launch in 2021.

The bug itself only recently became exploitable, however, after the Cosmos developers launched a new third-party application called IBC middleware, which allows ICS20 (Interchain token standard) tokens to cross chains.

"This really goes to show how easily trust assumptions can be broken and new functionality, or feature additions, roll out new vulnerabilities. It's one more example that underscores the value of defense-in-depth," said Asymmetric. This vulnerability really goes to show that more research on cross-chain security risks is really needed to be able to protect the multichain ecosystem properly. According to a GitHub commit from around three weeks ago, Cosmos dev Carlos Rodriguez fixed this bug.

In October 2022, another "critical" security vulnerability was discovered that affected all chains with IBC connections. This has since been patched without an actual exploit.