GHSA-w5w5-2882-47pc: github.com/cosmos/cosmos-sdk's x/crisis does not charge ConstantFee
N/A
CVSS Score
Basic Information
CVE ID
-
GHSA ID
EPSS Score
-
CWE
-
Published
6/30/2023
Updated
6/30/2023
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
-
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/cosmos/cosmos-sdk | go | <= 0.50.0-alpha.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from missing fee deduction logic in the x/crisis module's core processing functions. The Keeper.VerifyInvariant method (in keeper.go) and its associated message handler (in handler.go) are responsible for processing invariant verification requests. The documentation explicitly states these functions should charge a ConstantFee to prevent spam but fail to do so. The handler would typically be where transaction validation occurs, and the keeper method would execute the actual invariant check - both critical points where fee deduction should happen. The high confidence comes from the module architecture patterns in Cosmos SDK and the explicit description of missing fee charging in these core processing paths.