CVE-2024-32644: 
vulnerability analysis and mitigation

Evmos, a scalable, high-throughput Proof-of-Stake EVM blockchain that is fully compatible and interoperable with Ethereum, contained a critical vulnerability prior to version 17.0.0. The vulnerability (CVE-2024-32644) was discovered by an external contributor @iczc and allowed attackers to mint arbitrary tokens due to state synchronization issues between Cosmos SDK and EVM states during transaction execution (Vendor Advisory).

The vulnerability stems from the way state transitions are handled between Cosmos SDK and EVM states. The issue occurs in the stateDB.Commit() method, which is responsible for syncing states by iterating through dirtyStorage and comparing it with originStorage. The vulnerability arises when a contract's storage state changes during a transaction but returns to its original value before the transaction completes. In this scenario, since the final dirtyStorage matches originStorage, the intermediate state changes are not properly persisted, making the transaction behave non-atomically (Vendor Advisory). The vulnerability has been assigned a CVSS v3.1 base score of 9.1 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) (NVD).

The vulnerability is classified as critical as it could lead to the draining of funds through creative smart contract interactions. Attackers could exploit this issue to mint arbitrary tokens by manipulating state transitions during transaction execution (Vendor Advisory).

The exploit involves a sequence of steps: 1) A user sends a transaction to a smart contract that calls a precompile, 2) The smart contract changes its state from A to B, 3) The contract calls the precompile, 4) The contract reverts its state from B back to A. Due to the synchronization issue, the intermediate state changes are not properly accounted for, making the transaction non-atomic (Vendor Advisory).

The vulnerability has been patched in Evmos version 17.0.0 and later. Users and operators are strongly advised to upgrade to the patched version to prevent potential exploitation (Vendor Advisory).