Bounty

Osmosis

April

Cosmos

Cosmos developers have fixed a “critical” security bug in its Inter-Blockchain Communication (IBC) protocol that put at least $126 million at risk, said a blockchain security firm that privately notified Cosmos of the issue.
“We privately disclosed the vulnerability through the Cosmos HackerOne Bug Bounty program and the issue is now patched,” Asymmetric Research <a href="https://www.asymmetric.re/blog/cosmos-ibc-reentrancy-infinite-mint" target="_blank" rel="noopener nofollow">said</a> on April 23.
“No malicious exploitation took place and no funds were lost,” it added.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-04/32ed2612-cbe9-487f-ba4a-9ef01a0fea80.jpg" alt="" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/asymmetric_re/status/1782765042540138805" target="_blank" rel="noopener nofollow">Asymmetric Research</a>
 </figcaption>
</figure>
The bug could have allowed a reentrancy attack, allowing a hacker to mint infinite tokens on IBC-connected chains such as Osmosis and other decentralized finance ecosystems on Cosmos.
<blockquote data-ct-non-breakable="true">
 “We believe at least 126M+ in assets could have been stolen on Osmosis. However, rate limiting on Osmosis slows down the damage that could be caused.”
</blockquote>
Rate limits serve to prevent or at least mitigate attacks that attempt to overwhelm a system by controlling the rate at which requests are made.
Asymmetric noted the bug has existed in ibc-go, a high-level programming language implementation of IBC, since it launched in 2021.
However, the bug only recently became exploitable after Cosmos devs launched a new third-party application called IBC middleware, which allows tokens of the&nbsp;ICS20 interchain token standard&nbsp;<a href="https://cointelegraph.com/learn/what-is-blockchain-interoperability-a-beginners-guide-to-cross-chain-technology">to cross chains</a>.
Related: <a href="https://cointelegraph.com/news/cosmos-hub-greenlights-atom-inflation-cut-for-security-boost">Cosmos Hub greenlights ATOM inflation cut for security boost</a>
“This issue demonstrates how easy it is to break trust assumptions and introduce new vulnerabilities by adding new features and functionality. It is also another example of the importance of defense-in-depth,” Asymmetric emphasized.
<blockquote data-ct-non-breakable="true">
 “This vulnerability highlights the critical need for more research into cross-chain security risks to protect the multichain ecosystem better.”
</blockquote>
The bug was patched up by Cosmos dev Carlos Rodríguez about three weeks ago, a GitHub <a href="https://github.com/cosmos/ibc-go/security/advisories/GHSA-j496-crgh-34mx" target="_blank" rel="noopener nofollow">commit</a> shows.
Another “critical” security vulnerability was <a href="https://cointelegraph.com/news/cosmos-co-founder-says-a-major-security-vulnerability-has-been-uncovered-on-ibc">identified in the IBC protocol</a> in October 2022, which impacted all IBC-connected chains but was patched before any potential exploit.
Magazine:&nbsp;<a href="https://cointelegraph.com/magazine/dao-hyped-voting-decentralization/">Are DAOs overhyped and unworkable? Lessons from the front lines</a>

Cosmos patches ‘critical’ IBC protocol bug, saving $126M

Cointelegraph

Other articles published on Apr 24, 2024

Ethereum Sees Decline In Whale Interest Amid Rising Bearish Threats: What’s Next For ETH Price?

AI Hallucinations Are not Always bad – They Can Create New Antibiotics

The United States threatens to disconnect China from the Dollar

Top 5 Crypto Sportsbooks: A Comprehensive Guide to the Best Gambling Sites

5 Hidden Gem Altcoins for Post-Bitcoin Halving Investment Plan

Bitcoin aims $70,000 this week as FOMO takes over the crowd

Join our free newsletter for daily crypto updates!