GHSA-47ww-ff84-4jrg: 
vulnerability analysis and mitigation

A high-severity vulnerability (GHSA-47ww-ff84-4jrg) was discovered in the Cosmos SDK's groups module, affecting versions <= v0.47.16 and <= v0.50.12. The vulnerability was initially reported on February 28, 2025, through the Cosmos Bug Bounty Program by researcher dongsam on HackerOne, and was officially disclosed on March 12, 2025. The issue affects validators, full nodes, and users on chains that utilize the groups module (GitHub Advisory).

The vulnerability exists in the groups module where malicious proposals can trigger errors in the module's end blocker, potentially resulting in a chain halt. The severity is rated as High with a CVSS v4.0 score of 8.7. The technical assessment shows the vulnerability has Network attack vector, Low attack complexity, requires No privileges, and needs No user interaction. The primary impact is on system availability, with no direct impact on confidentiality or integrity (GitHub Advisory).

The vulnerability's primary impact is the potential for chain halts in Cosmos SDK chains that use the x/group module. Any users with the ability to interact with the groups module could potentially introduce this problematic state, making it a significant threat to network availability (GitHub Advisory).

The vulnerability has been patched in Cosmos SDK versions v0.50.13 and v0.47.17. The fix has been extensively tested, including verification on a local v0.50 testnet with the failing state, and successful runs on both Xion Mainnet and Zetachain Mainnet. There are no known workarounds for this issue, and it is strongly advised that affected chains apply the update (GitHub Advisory).