Cosmos Fixes 'Critical' IBC Protocol Flaw, Protects $126M

2024/04/24 03:32

A blockchain security firm that had privately disclosed the issue to Cosmos said the developers of Cosmos have fixed a "critical" security bug in their Inter-Blockchain Communication (IBC) protocol that was putting at least $126 million at risk.

"The vulnerability was privately disclosed through the Cosmos HackerOne Bug Bounty program, and the issue is now patched," added the Asymmetric Research team.

"No malicious exploitation took place, and no funds were lost," it added.

This bug could have led to a reentrancy attack that would allow a hacker to mint an infinite amount of tokens on IBC-connected chains, such as Osmosis and others within the decentralized financial ecosystem of Cosmos. "On Osmosis, the rate limiting would slow down the damage. We believe that at least $126M+ in assets could be stolen on Osmosis. However, the rate limiting on Osmosis is slowing down the damage which can be caused.".

Rate limits are meant to a cold water, or at least mitigate, on any attacks trying to flood a system by regulating the speed with which requests may be made.

Asymmetric has been notified of this bug, which has been a part of ibc-go since the launch in 2021.

The bug itself only recently became exploitable, however, after the Cosmos developers launched a new third-party application called IBC middleware, which allows ICS20 (Interchain token standard) tokens to cross chains.

"This really goes to show how easily trust assumptions can be broken and new functionality, or feature additions, roll out new vulnerabilities. It's one more example that underscores the value of defense-in-depth," said Asymmetric. This vulnerability really goes to show that more research on cross-chain security risks is really needed to be able to protect the multichain ecosystem properly. According to a GitHub commit from around three weeks ago, Cosmos dev Carlos Rodriguez fixed this bug.

In October 2022, another "critical" security vulnerability was discovered that affected all chains with IBC connections. This has since been patched without an actual exploit.

Gain a broader understanding of the crypto industry through informative reports, and engage in in-depth discussions with other like-minded authors and readers. You are welcome to join us in our growing Coinlive community:https://t.me/CoinliveSG

Add Comment

LoginLeave your comments

0 Comments

Earliest

Load more comments

More news about bug bounty programme

Oct 21
Friend.Tech Launches Bug Bounty Program With Rewards Up To 1 Million USDC
Bullish
Bearish
Sep 15
ssv.network launches bug bounty program with bounty up to $1 million
Bullish
Bearish
Aug 07
Google Pays $15,000 Bug Bounty to Apple Security Team
Bullish
Bearish
May 24
Kwenta Launches Bug Bounty Program With Top Prize of $500,000
Bullish
Bearish
Apr 21
Sui Foundation Partners with Immunefi on Bug Bounty Program with a Maximum Bounty of $500,000
Bullish
Bearish
Apr 19
pStake launches bug bounty on Immunefi
Bullish1
Bearish
Apr 12
OpenAI launches bug bounty program for its artificial intelligence systems
Bullish
Bearish
Apr 03
Aave Community Launches Proposal to Launch Bug Bounty Program in Immunefi
Bullish2
Bearish
Mar 20
Filecoin Updates Bug Bounty Policy, Increases Maximum Bonus to $500,000
Bullish2
Bearish1
Nov 26
Uniswap Launches Up to 3 Million USDC Contract Additional Bug Bounty Program
Bullish
Bearish

Cosmos Fixes 'Critical' IBC Protocol Flaw, Protects $126M

More news about bug bounty programme

More news about bug bounty programme

HAQQ Sparks Innovation with $50K Bounty Hackathon at Istanbul Blockchain Week

Immunefi spammed by ChatGPT-generated web3 bug bounty reports

LayerZero and Immunefi launch largest crypto bug bounty program with up to $15M in rewards

Coinbase Foils Extortion Attempt, Reinforces Bug Bounty Program

PrimeXBT Announces New Platform Test And $100,000 Bug Bounty Trading Contest

Aurora pays $6M bug bounty to ethical security hacker through Immunefi

[Link to FM] Coinbase discloses a list of 50 assets to be launched in the second quarter, NFT market LooksRare launches a bug bounty program

MakerDAO Launches Largest Bug Bounty Ever, Awarding $10M

After Hack, Ronin Offers $1M Bug Bounty, Plans to Double Number of Nodes

Plan for $1M bug bounties and double the nodes in wake of $600M Ronin hack