Critical CosmosSDK Security Advisory [Updated]

Two days ago, a critical security vulnerability in the CosmosSDK was reported to the Tendermint team through [email protected].

A patch for this critical issue will be available in v 0.34.6 of the CosmosSDK which is available now and we will provide technical details about the vulnerability within 7-10 business days to give a reasonable amount of time for to harden their systems. In response to this issue, we are currently coordinating a hard fork to upgrade the Cosmos mainnet, and we are reaching out to validators to ensure that they are available to respond during the network transition at block height 482100.

If you’re a service provider upgrading a full node, we recommend updating to this latest, most secure version of the CosmosSDK immediately.

Because of the severity of the issue, we have provided early notification to organizations that may be affected so that systems can be prepared for the upgrade when v. 0.34.6 of the CosmosSDK is available.

The release tag is: https://github.com/cosmos/cosmos-sdk/tree/release/v0.34.6

Also worth noting that the vulnerability cannot be exploited to generate new ATOMs (or tokens), nor can it be exploited to steal someone else’s ATOMs (or tokens).

update and sync the last soft ok.

We have created a proposal on the Cosmos Hub to signal when a validator has successfully upgraded their nodes in order to gauge readiness of the network for the fork.

https://hubble.figment.network/cosmos/chains/cosmoshub-2/governance/proposals/8

Why was this dubbed a “hard fork”? It seems to me that it was purely a “patch”.

Yeah I’m confused a bit too. So it is a DoS vulnerability? Crash fault?

I was one of the validators that was late and subsequently jailed, so if any other validators are still stuck on how to resolve it (or for future reference), here was the process:

Step 1. Update to latest v0.34.6 build with the security patch

Step 2. Remove current blockchain state. gaiad unsafe-reset-all to wipe .gaiad/data folder.

Step 3. Download snapshot of blockchain tar file into the data directory. https://cosmos-data-backup.s3.ap-northeast-2.amazonaws.com/data_hub2_backup_before_unbonding_hardfork.tar

Step 4. Run tar -xvf on the snapshot and move into the data directory.

Step 5. Within the config file, add updated peers from this list: https://github.com/Ethermat/cosmos-topology/blob/master/peers_0.31.5.txt

Step 5. Start and sync gaiad. Once synced to unjail validator run: gaiacli tx slashing unjail

If anyone is having issues syncing from genesis, please attempt to sync with version v0.34.7

Vulnerability Coordination Update: CosmosSDK Security Advisory 05-30-2019 On Tuesday, May 28th, a high-severity security vulnerability in the staking module of the CosmosSDK was reported to the Tendermint team through [email protected] . The issue was reported at 21:57 UTC, with triage beginning immediately among core development teams who were operating in North America, Europe, and Australia. The Vulnerability The Cosmos economic security model depends on a set of related concepts : Bonding, Unbonding, Delegation and Redelegation. As a way to strike a balance between decentralization and fast block times, we also only support a fixed number of validators in the Cosmos Hub and allow any Atom holder to participate through delegation. One of the key components to this security model is that once atoms have been bonded, they cannot be unbonded for 21 days. In addition to this, however, we also wanted to improve the quality of life for delegators who took a risk and delegated to a validator who never made into the active set of validators ranked by delegated stake by allowing for instant unbonding. The vulnerability that was reported demonstrated a flaw in the code…

Excerpt (1196 of 13508 characters). Read the whole post on the forum ↗

Jessysaurusrex:

For security to be successful, it must be a shared responsibility across the entire Cosmos ecosystem. More than anything else, we are extremely proud of the quick coordination between the bug reporter, the triage team, core developers, impacted organizations, and the Cosmos Hub validators that resolved this issue.

my, how times have changed