Miggo Logo

GHSA-gwj5-wp6r-5q9f: Cronos vulnerable to DoS through unintended Contract Selfdestruct

8.2

CVSS Score
3.1

Basic Information

CVE ID
-
EPSS Score
-
Published
8/11/2022
Updated
4/5/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/crypto-org-chain/cronosgo<= 0.7.00.8.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from a bug in Ethermint's handling of contract selfdestruct operations, specifically in how bytecode deletion affected contracts sharing the same CodeHash. The Cronos project inherited this vulnerability through its dependency on a vulnerable Ethermint version (v0.10.0). The provided commit diff shows Cronos patched the issue by updating to Ethermint v0.11.0, but no vulnerable functions were explicitly modified in Cronos' own codebase. The root cause lies in Ethermint's DeleteAccount function (in x/evm/keeper/statedb.go), which improperly handled bytecode deletion. Since the question focuses on Cronos' codebase (github.com/crypto-org-chain/cronos), and no direct vulnerable functions were identified in its code, the array remains empty.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

In *ronos no**s runnin* v*rsions ***or* v*.*.*, t** *ontr**t s*l***stru*t invo**tion p*rm*n*ntly r*mov*s t** *orr*spon*in* *yt**o** *rom t** int*rn*l **t***s* stor***. *ow*v*r, *u* to * *u* in *t**rmint, *ll *ontr**ts t**t us** t** i**nti**l *yt**o**

Reasoning

T** vuln*r**ility st*ms *rom * *u* in *t**rmint's **n*lin* o* *ontr**t s*l***stru*t op*r*tions, sp**i*i**lly in *ow *yt**o** **l*tion *****t** *ontr**ts s**rin* t** s*m* *o****s*. T** *ronos proj**t in**rit** t*is vuln*r**ility t*rou** its **p*n**n*y