Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable

{"

The Flaw in Detail":"The vulnerability lies in the code that reconciles Ethereum Virtual Machine (EVM) state with the Cosmos SDK x/bank module. The EVM StateDB tracks only an account's spendable balance, while vesting accounts in SDK state hold both a spendable and a locked balance.","

The Fix Process":"Cosmos Labs initially assessed the vulnerability as posing no risk to funds on live networks. However, they later confirmed that all Cosmos EVM chains were affected regardless of decimal configuration. The fix was then routed through the public silent patch process.","

The Impact":"Chains on 0.6.x mint and burn on the backing SDK ledger, causing a supply overflow that halts the chain. Chains running 0.7.x set balances directly in x/bank and accept changes that survive a uint256 to int256 conversion. Both halves run inside a single transaction with a net supply change of zero.","

The Mitigation Steps":"Operators are advised to upgrade to v0.6.2 or v0.7.2 or later, applying it as a coordinated network upgrade. Halt rather than vote. Chains that cannot upgrade at once are told to stop block production instead of running a coordinated governance upgrade. The advisory states there is no configuration-only mitigation, and that disabling the staking precompile removes the primary trigger path but is not a substitute for the patch."}