-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper access controls in CreateClawbackVestingAccount. The advisory explicitly states the remediation requires restricting this function's usage to only the recipient account, indicating it was previously callable by any user. This matches the attack vector described where attackers could arbitrarily create vesting accounts at target addresses. The function's presence in the vesting module and its role in account creation directly align with the described vulnerability mechanism.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/evmos/evmos/v13/x/vesting | go | <= 13.0.2 | |
| github.com/evmos/evmos/v13 | go | <= 13.0.2 |