Bounty

Ethereum

Evmos

Foundation

Cosmos

A Web3 security researcher received $150,000 from the Cosmos Network for identifying a critical bug that could halt the Evmos blockchain and all its decentralized applications.
On Oct. 29, a <a rel="noopener noreferrer nofollow" href="https://crypto.news/tag/web3/">Web3</a> security researcher from Spearbit with the username jayjonah.eth made an <a rel="noopener noreferrer nofollow" href="https://x.com/jayjonah_eth/status/1850958520344027273" target="_blank">X post</a> containing a blogpost he wrote about finding a bug in the Evmos(<a rel="noopener noreferrer nofollow" href="https://crypto.news/price/evmos/">EVMOS</a>) blockchain that could have proved catastrophic to its operations.
His efforts were rewarded by the <a rel="noopener noreferrer nofollow" href="https://crypto.news/tag/cosmos/">Cosmos Network</a> with a $150,000 payout for identifying the vulnerability. He discovered the bug while participating in the Evmos Bug Bounty Program on the bug bounty platform Immunefi, which has been active since November 2022.
A crypto bug bounty offers incentives to developers and researchers to help identify bugs and vulnerabilities within a system.
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
 <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 Discovered a $150,000 <a href="https://twitter.com/EvmosOrg?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">@EvmosOrg</a> vulnerability on <a href="https://twitter.com/immunefi?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">@immunefi</a> just by reading the docs! 📜🔍 Check out my latest write-up to see how paying attention to the basics led to a critical bug. 👇 <a href="https://twitter.com/SpearbitDAO?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">@SpearbitDAO</a> <a rel="noopener noreferrer nofollow" href="https://t.co/6WLJrgAtJz" target="_blank">https://t.co/6WLJrgAtJz</a>— jayjonah.eth (@jayjonah_eth) <a href="https://twitter.com/jayjonah_eth/status/1850958520344027273?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">October 28, 2024</a>
 </blockquote>
 <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
In his <a href="https://medium.com/@jjordanjjordan/150-000-evmos-vulnerability-through-reading-documentation-d26328590a7a" target="_blank" rel="noopener noreferrer nofollow">blog post</a>, the researcher explained that he came across the concept of “module accounts” while reviewing the Cosmos documentation, describing this review as “the first step” in identifying potential problems, as the documentation provides “the foundation” for understanding a blockchain.
He found a section within the document which read as follows:
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
 “Typically, these addresses are module accounts. If these addresses receive funds outside the expected rules of the state machine, invariants are likely to be broken and could result in a halted network,” wrote Evmos.
</blockquote>
You might also like: <a rel="noopener noreferrer nofollow" href="https://crypto.news/jump-crypto-offers-solana-devs-up-to-1m-in-firedancer-bug-bounty-program/"> Jump Crypto offers Solana devs up to $1m in Firedancer bug bounty program </a>
According to jayjonah.eth, this clause indicated that if users sent funds to module accounts, it could cause the blockchain to break. He then tested this by sending funds to the module accounts.
“At this point, no more blocks are being produced and the chain has completely halted. This breaks the Evmos blockchain and all the DApps built on it,” he wrote.
He reported his findings to the Evmos team, receiving $150,000, the highest prize awarded for a “critical” level bug. The researcher emphasized that the bug was a “low-hanging fruit” — simple yet easy to overlook.
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
 “This bug taught me a few important things as a security researcher. The first, and most obvious, is to always thoroughly read the documentation of the project you’re investigating,”
 -jayjonah.eth.
</blockquote>
Other projects have also been known to launch bug bounties to help detect hidden threats in their systems. Last August, Layer3, a decentralized attention layer project, <a rel="noopener noreferrer nofollow" href="https://crypto.news/layer3-launches-500k-bounty-program-to-strengthen-security/">launched</a> a bug bounty program in partnership with HackenProof. The bug bounty offers a reward of up to $500,000.
In July, Immunefi <a rel="noopener noreferrer nofollow" href="https://crypto.news/immunefi-and-ethereum-foundation-launch-attackathon-to-enhance-security-for-ethereum/">collaborated</a> with the Ethereum Foundation to launch “Attackathon,” an audit contest designed to challenge and enhance the Ethereum network’s security.
Read more: <a rel="noopener noreferrer nofollow" href="https://crypto.news/immunefi-and-ethereum-foundation-launch-attackathon-to-enhance-security-for-ethereum/"> Immunefi and Ethereum Foundation launch “Attackathon” to enhance security for Ethereum </a>

Web3 researcher awarded $150k for finding critical bug in Evmos blockchain

crypto.news

Other articles published on Oct 29, 2024

6 Best Cryptos to Buy This November: Potential Millionaire Makers

Analyst Says DOGE can never hit $23, but this ai altcoin could surge 40,000%

Boost Your Income with CashClick: Your Go-To Rewards Platform

Trump’s Crypto Venture World Liberty Prepares Stablecoin Initiative

New DEX Outshines Binance (BNB) With No KYC and Cross-Chain Capabilities; Jupiter Price Rallies

November’s Bull Run Will Give You a Second Chance to Secure 2021-Style Solana Gains With This Hig...

Join our free newsletter for daily crypto updates!