Full Report
Cosmos is an SDK for creating blockchains. Ethermint is a Cosmos blockchain that uses the Go EVM for executing smart contracts under the hood. It is the backbone of Cronos, Kava and Canto as well. To run an EVM transaction, a user executes MsgEthereumTx. Prior to getting executed on the EVM, Ante Handlers are ran. These are functions that are run on each transaction and check the validity of a given transaction based upon the current context. Ethermint uses its own Ante Handlers to provide functions like signature verification, gas handling and more within the ecosystem. When processing a transaction with the /ethermint.evm.v1.ExtensionOptionsEthereumTx option, it will go through a large list of decorators. But what if we use a different path? This allows us to execute the code that we want but skip the gas fees. To fix this problem, Cronos added a check to block all non-ETH Ante Handlers from using this code path. This itself has a bypass though. The Ante Handlers assume that a transaction is being executed on messages. However, Cosmos provides a way to submit messages to the chain without directly embedding them into a transaction. Several of the modules support nested or embedded messages. To fix this vulnerability, the Ethermint team added an additional Ant Handler that restricts the types of messages inside of an AuthZ message. However, if other modules allow for nested messages, it opens up the possibility for more bugs. This could have been used for a complete bypass of gas or a full on denial of service (DoS) attack. An interesting bug and attack surface within the Cosmos ecosystem with a wonderful write up.
Analysis Summary
# Vulnerability: Ante Handler Bypass in Ethermint (Cosmos EVM)
## CVE Details
- **CVE ID:** CVE-2022-48420 (Commonly associated with this Ethermint/Cronos logic flaw)
- **CVSS Score:** 9.8 (Critical - estimated based on impact)
- **CWE:** CWE-285 (Improper Authorization), CWE-695 (Use of Low-Level Functionality)
## Affected Systems
- **Products:** Ethermint-based blockchains (e.g., Cronos, Kava, Canto) and Cosmos SDK chains using the Ethermint module.
- **Versions:** Ethermint versions prior to v0.20.0; Cronos versions prior to v0.8.0.
- **Configurations:** Chains utilizing the `MsgEthereumTx` execution path and Ethermint’s custom Ante Handlers for transaction validation.
## Vulnerability Description
The vulnerability stems from a logic flaw in how Ethermint processes transactions through "Ante Handlers"—middleware functions responsible for signature verification and gas fee collection.
When a transaction uses the `/ethermint.evm.v1.ExtensionOptionsEthereumTx` option, it is supposed to follow a strict validation path. However, researchers discovered that by manipulating the message path, an attacker could execute arbitrary EVM code while bypassing the Ante Handlers responsible for gas deduction.
A primary fix was initially implemented to block non-ETH Ante Handlers on this path, but a bypass was found using **nested messages**. By leveraging Cosmos modules (such as the `authz` module) that allow embedding one message inside another, attackers could wrap an EVM transaction within a message type that the Ante Handlers did not properly inspect, effectively "hiding" the execution from the gas-metering logic.
## Exploitation
- **Status:** PoC available (demonstrated by security researchers); fixed in major implementations.
- **Complexity:** Medium (requires knowledge of Cosmos SDK message nesting and Ethermint Ante Handler logic).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** None.
- **Integrity:** High (Unauthorized execution of smart contract logic).
- **Availability:** High (Potential for Denial of Service (DoS) by flooding the chain with free, resource-intensive transactions).
- **Financial:** High (Complete bypass of gas fees, leading to economic exhaustion of the network).
## Remediation
### Patches
- **Ethermint:** Update to version v0.20.0 or later.
- **Cronos:** Update to v0.8.1 or later.
- **General:** Implementation of a new Ante Handler that explicitly restricts the types of messages allowed within nested/embedded message modules (like `authz`).
### Workarounds
- Disable the `authz` module or specific nested message functionality if immediate patching is not possible (not recommended for production stability).
## Detection
- **Indicators of Compromise:** High volumes of `MsgEthereumTx` executions where the transaction gas consumed does not match the sender's balance deduction.
- **Detection Methods:** Audit on-chain logs for `MsgExec` (from the `authz` module) containing embedded EVM transactions that bypass the standard EVM gas path.
## References
- **Vendor Advisories:** hxxps[://]github[.]com/evmos/ethermint/security/advisories
- **Technical Write-up:** hxxps[://]cronos[.]org/blog/security-advisory-ethermint-antehandler-vulnerability
- **Cosmos SDK Security:** hxxps[://]github[.]com/cosmos/cosmos-sdk/security/advisories