Miggo Logo
Miggo Vulnerability Database
→
GHSA-mx2j-7cmv-353c

GHSA-mx2j-7cmv-353c: wasmvm: Malicious smart contract can slow down block production

N/A

CVSS Score

Basic Information

CVE ID
-
GHSA ID
GHSA-mx2j-7cmv-353c
EPSS Score
-
CWE
-
Published
2/4/2025
Updated
2/6/2025
KEV Status
No
Technology
TechnologyRust

Technical Details

CVSS Vector
-
Package NameEcosystemVulnerable VersionsFirst Patched Version
cosmwasm-vmrust= 2.2.02.2.1
cosmwasm-vmrust>= 2.1.0, < 2.1.62.1.6
cosmwasm-vmrust>= 2.0.0, < 2.0.92.0.9
cosmwasm-vmrust< 1.5.101.5.10
github.com/CosmWasm/wasmvmgo< 1.5.81.5.8
github.com/CosmWasm/wasmvm/v2go>= 2.2.0, < 2.2.22.2.2
github.com/CosmWasm/wasmvm/v2go>= 2.1.0, < 2.1.52.1.5
github.com/CosmWasm/wasmvm/v2go>= 2.0.0, < 2.0.62.0.6

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from insufficient gas metering for memory operations and host calls. Commit diffs show added gas cost fields (read_region_*, string_from_bytes_cost, host_call_cost) and modified LinearGasCost with overflow checks. These changes indicate previous versions lacked proper gas accounting for these operations, enabling resource exhaustion attacks through malicious contracts performing un-metered expensive computations.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

# *W*-****-*** **S*v*rity** M**ium (Mo**r*t* + Lik*ly)[^*] *******t** v*rsions:** - w*smvm >= *.*.*, < *.*.* - w*smvm >= *.*.*, < *.*.* - w*smvm >= *.*.*, < *.*.* - w*smvm < *.*.* **P*t**** v*rsions:** - w*smvm *.*.*, *.*.*, *.*.*, *.*.* ## **

Reasoning

T** vuln*r**ility st*mm** *rom insu**i*i*nt **s m*t*rin* *or m*mory op*r*tions *n* *ost **lls. *ommit *i**s s*ow ***** **s *ost *i*l*s (r***_r**ion_*, strin*_*rom_*yt*s_*ost, *ost_**ll_*ost) *n* mo*i*i** Lin**r**s*ost wit* ov*r*low ****ks. T**s* ***n