Skip to content

ICS-2024-001: The check for the height of cryptographic equivocation evidence is missing

Moderate
mpoke published GHSA-83qr-9v2h-qxp4 Aug 14, 2024

Package

gomod github.com/cosmos/gaia (Go)

Affected versions

14.2.x < x <= 17.2.x

Patched versions

>= 17.3.x

Description

Summary

An issue was identified in the Interchain Security (ICS) module that could result in the slashing of a validator for an "old" equivocation. The height-base filter for consumer equivocation evidence introduced in v2.4.0-lsm was re-enabled.

Details

ICS v2.4.0-lsm introduced a height-base filter for consumer equivocation evidence. This feature enables a provider to set per consumer chain minimum heights for which cryptographic evidence is considered valid. The Cosmos Hub v14 upgrade bumped ICS to v2.4.0-lsm and also set the minimum evidence height for both neutron-1 and stride-1 consumer chains to their respective height at that time (see PR). As a result, "older" cryptographic evidence was no longer accepted by the Hub.

The Cosmos Hub v15 upgrade bumped ICS to v3.3.3-lsm, which had the height-base filter for consumer equivocation evidence disabled.

Severity

Moderate

CVE ID

No known CVE

Weaknesses

No CWEs