GHSA-gwj5-wp6r-5q9f: Cronos vulnerable to DoS through unintended Contract Selfdestruct
8.2
Basic Information
Technical Details
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
github.com/crypto-org-chain/cronos | go | <= 0.7.0 | 0.8.0 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stems from a bug in Ethermint's handling of contract selfdestruct operations, specifically in how bytecode deletion affected contracts sharing the same CodeHash. The Cronos project inherited this vulnerability through its dependency on a vulnerable Ethermint version (v0.10.0). The provided commit diff shows Cronos patched the issue by updating to Ethermint v0.11.0, but no vulnerable functions were explicitly modified in Cronos' own codebase. The root cause lies in Ethermint's DeleteAccount
function (in x/evm/keeper/statedb.go), which improperly handled bytecode deletion. Since the question focuses on Cronos' codebase (github.com/crypto-org-chain/cronos), and no direct vulnerable functions were identified in its code, the array remains empty.