-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two interrelated issues: (1) The PercentageDecisionPolicy.Allow method in types.go performed division by totalPowerDec without validating it was non-zero, and (2) the UpdateGroupMembers() function in msg_server.go allowed groups to reach a state where total weight was zero. The division-by-zero in Allow was directly exploitable via proposals targeting such groups. The patches addressed both the root cause (preventing zero-weight groups) and the symptom (handling zero totalPowerDec in the division). The test cases and changelog confirm these fixes.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/cosmos/cosmos-sdk | go | <= 0.47.15 | 0.47.16-ics-lsm |
| github.com/cosmos/cosmos-sdk | go | >= 0.50.0-alpha.0, <= 0.50.11 | 0.50.12 |