Cosmos-SDK Vulnerability Retrospective: Security Advisory Jackfruit, October 12, 2021

On October 8, 2021, the team at Provenance reported a high-severity vulnerability in v0.43.x and v0.44.{0,1} of the Cosmos-SDK. On October 12, 2021, a security patch was released in v0.44.2 of the Cosmos-SDK that addresses the issue. Announcements can be found here . Following our vulnerability disclosure policy , we are here releasing more details about the vulnerability, one week after the release. The Bug Affected versions of the SDK were vulnerable to a consensus halt due to non-deterministic behaviour in a `ValidateBasic` method in the `x/authz` module. The `MsgGrant` of the `x/authz` module contains a `Grant` field which includes a user-defined expiration time for when the authorization grant expires. In `Grant.ValidateBasic()`, that time is compared to the node’s local clock time: See the cosmos-sdk/authorization_grant.go at master · cosmos/cosmos-sdk · GitHub ``` func (g Grant) ValidateBasic() error { if g.Expiration.Unix() < time.Now().Unix() { return sdkerrors.Wrap(ErrInvalidExpirationTime, "Time can't be in the past") } ``` Local clock times are subjective and thus non-deterministic. An attacker could craft many Grants, with different but close…

Excerpt (1191 of 4822 characters). Read the whole post on the forum ↗