{"cve":"CVE-2024-37158","nvd":{"published":"2024-06-17T14:15:10.430","modified":"2026-06-17T07:37:51.953","status":"Analyzed","description":"Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. Preliminary checks on actions computed by the clawback vesting accounts are performed in the ante handler. Evmos core, implements two different ante handlers: one for Cosmos transactions and one for Ethereum transactions. Checks performed on the two implementation are different. The vulnerability discovered allowed a clawback account to bypass Cosmos ante handler checks by sending an Ethereum transaction targeting a precompile used to interact with a Cosmos SDK module. This vulnerability is fixed in 18.0.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","score":8.1},"cwes":["CWE-691"],"references":["https://github.com/evmos/evmos/commit/b2a09ca66613d8b04decd3f2dcba8e1e77709dcb","https://github.com/evmos/evmos/security/advisories/GHSA-pxv8-qhrh-jc7v","https://github.com/evmos/evmos/commit/b2a09ca66613d8b04decd3f2dcba8e1e77709dcb","https://github.com/evmos/evmos/security/advisories/GHSA-pxv8-qhrh-jc7v"],"products":["evmos:evmos"],"source":"nvd","synced_at":"2026-10-19T21:52:00.836172422+00:00"},"epss":{"cve":"CVE-2024-37158","score":0.0044,"percentile":0.38253,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-pxv8-qhrh-jc7v","url":"https://osv.dev/vulnerability/GHSA-pxv8-qhrh-jc7v","summary":"evmos allows transferring unvested tokens after delegations","modified":"2026-09-10T03:50:15.693743484Z","packages":[{"ecosystem":"Go","name":"github.com/evmos/evmos/v17","purl":"pkg:golang/github.com/evmos/evmos/v17","ranges":["<18.0.0"],"fixed":["18.0.0"]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v16","purl":"pkg:golang/github.com/evmos/evmos/v16","ranges":["<18.0.0"],"fixed":["18.0.0"]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v15","purl":"pkg:golang/github.com/evmos/evmos/v15","ranges":["<18.0.0"],"fixed":["18.0.0"]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v14","purl":"pkg:golang/github.com/evmos/evmos/v14","ranges":["<18.0.0"],"fixed":["18.0.0"]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v13","purl":"pkg:golang/github.com/evmos/evmos/v13","ranges":["<18.0.0"],"fixed":["18.0.0"]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v12","purl":"pkg:golang/github.com/evmos/evmos/v12","ranges":["<18.0.0"],"fixed":["18.0.0"]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v11","purl":"pkg:golang/github.com/evmos/evmos/v11","ranges":["<18.0.0"],"fixed":["18.0.0"]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v10","purl":"pkg:golang/github.com/evmos/evmos/v10","ranges":["<18.0.0"],"fixed":["18.0.0"]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v9","purl":"pkg:golang/github.com/evmos/evmos/v9","ranges":["<18.0.0"],"fixed":["18.0.0"]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v8","purl":"pkg:golang/github.com/evmos/evmos/v8","ranges":["<18.0.0"],"fixed":["18.0.0"]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v7","purl":"pkg:golang/github.com/evmos/evmos/v7","ranges":["<18.0.0"],"fixed":["18.0.0"]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v6","purl":"pkg:golang/github.com/evmos/evmos/v6","ranges":["<18.0.0"],"fixed":["18.0.0"]}]},{"id":"GO-2024-2891","url":"https://osv.dev/vulnerability/GO-2024-2891","summary":"evmos allows transferring unvested tokens after delegations in github.com/evmos/evmos","modified":"2026-03-03T04:55:27.919592Z","packages":[{"ecosystem":"Go","name":"github.com/evmos/evmos","purl":"pkg:golang/github.com/evmos/evmos","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v2","purl":"pkg:golang/github.com/evmos/evmos/v2","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v3","purl":"pkg:golang/github.com/evmos/evmos/v3","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v4","purl":"pkg:golang/github.com/evmos/evmos/v4","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v5","purl":"pkg:golang/github.com/evmos/evmos/v5","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v6","purl":"pkg:golang/github.com/evmos/evmos/v6","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v7","purl":"pkg:golang/github.com/evmos/evmos/v7","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v8","purl":"pkg:golang/github.com/evmos/evmos/v8","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v9","purl":"pkg:golang/github.com/evmos/evmos/v9","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v10","purl":"pkg:golang/github.com/evmos/evmos/v10","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v11","purl":"pkg:golang/github.com/evmos/evmos/v11","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v12","purl":"pkg:golang/github.com/evmos/evmos/v12","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v13","purl":"pkg:golang/github.com/evmos/evmos/v13","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v14","purl":"pkg:golang/github.com/evmos/evmos/v14","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v15","purl":"pkg:golang/github.com/evmos/evmos/v15","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v16","purl":"pkg:golang/github.com/evmos/evmos/v16","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v17","purl":"pkg:golang/github.com/evmos/evmos/v17","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v18","purl":"pkg:golang/github.com/evmos/evmos/v18","ranges":["<18.0.0"],"fixed":["18.0.0"]}]},{"id":"GO-2024-2926","url":"https://osv.dev/vulnerability/GO-2024-2926","summary":"Evmos is missing precompile checks in github.com/evmos/evmos","modified":"2026-03-03T04:55:30.557607Z","packages":[{"ecosystem":"Go","name":"github.com/evmos/evmos","purl":"pkg:golang/github.com/evmos/evmos","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v2","purl":"pkg:golang/github.com/evmos/evmos/v2","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v3","purl":"pkg:golang/github.com/evmos/evmos/v3","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v4","purl":"pkg:golang/github.com/evmos/evmos/v4","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v5","purl":"pkg:golang/github.com/evmos/evmos/v5","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v6","purl":"pkg:golang/github.com/evmos/evmos/v6","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v7","purl":"pkg:golang/github.com/evmos/evmos/v7","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v8","purl":"pkg:golang/github.com/evmos/evmos/v8","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v9","purl":"pkg:golang/github.com/evmos/evmos/v9","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v10","purl":"pkg:golang/github.com/evmos/evmos/v10","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v11","purl":"pkg:golang/github.com/evmos/evmos/v11","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v12","purl":"pkg:golang/github.com/evmos/evmos/v12","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v13","purl":"pkg:golang/github.com/evmos/evmos/v13","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v14","purl":"pkg:golang/github.com/evmos/evmos/v14","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v15","purl":"pkg:golang/github.com/evmos/evmos/v15","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v16","purl":"pkg:golang/github.com/evmos/evmos/v16","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v17","purl":"pkg:golang/github.com/evmos/evmos/v17","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v18","purl":"pkg:golang/github.com/evmos/evmos/v18","ranges":["<18.0.0"],"fixed":["18.0.0"]}]},{"id":"GO-2024-2927","url":"https://osv.dev/vulnerability/GO-2024-2927","summary":"Evmos is missing create validator check in github.com/evmos/evmos","modified":"2026-03-03T04:55:28.413195Z","packages":[{"ecosystem":"Go","name":"github.com/evmos/evmos","purl":"pkg:golang/github.com/evmos/evmos","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v2","purl":"pkg:golang/github.com/evmos/evmos/v2","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v3","purl":"pkg:golang/github.com/evmos/evmos/v3","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v4","purl":"pkg:golang/github.com/evmos/evmos/v4","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v5","purl":"pkg:golang/github.com/evmos/evmos/v5","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v6","purl":"pkg:golang/github.com/evmos/evmos/v6","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v7","purl":"pkg:golang/github.com/evmos/evmos/v7","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v8","purl":"pkg:golang/github.com/evmos/evmos/v8","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v9","purl":"pkg:golang/github.com/evmos/evmos/v9","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v10","purl":"pkg:golang/github.com/evmos/evmos/v10","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v11","purl":"pkg:golang/github.com/evmos/evmos/v11","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v12","purl":"pkg:golang/github.com/evmos/evmos/v12","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v13","purl":"pkg:golang/github.com/evmos/evmos/v13","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v14","purl":"pkg:golang/github.com/evmos/evmos/v14","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v15","purl":"pkg:golang/github.com/evmos/evmos/v15","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v16","purl":"pkg:golang/github.com/evmos/evmos/v16","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v17","purl":"pkg:golang/github.com/evmos/evmos/v17","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/evmos/evmos/v18","purl":"pkg:golang/github.com/evmos/evmos/v18","ranges":["<18.0.0"],"fixed":["18.0.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}