Vulnerability DatabaseGHSA-jg6f-48ff-5xrw

GHSA-jg6f-48ff-5xrw:
vulnerability analysis and mitigation

Overview

A critical vulnerability (GHSA-jg6f-48ff-5xrw) was discovered in IBC-Go's deserialization of acknowledgements that results in non-deterministic behavior which can halt a chain. The vulnerability affects IBC-Go version 7 and potentially earlier versions, impacting validators, full nodes, and IBC Middleware authors. The issue was initially reported on February 18, 2025, and patches were released on February 27, 2025 (GitHub Advisory).

Technical details

The vulnerability stems from non-deterministic JSON unmarshalling of IBC Acknowledgement, which can lead to chain halts. The issue has been assigned a Critical severity rating with a CVSS score of 9.3/10. The vulnerability is classified under CWE-502, and any user with the ability to open an IBC channel can potentially introduce this problematic state to the chain (GitHub Advisory).

Impact

The vulnerability can result in chain halts and affect transfer middlewares that deserialize and serialize acknowledgement packets. If exploited, transfers handled by affected middleware will fail or experience unexpected behavior if the serialization approach differs from the transfer app's. Validators applying patches in a rolling manner may experience halts during upgrades (GitHub Advisory).

Mitigation and workarounds

Two official patches have been released: IBC-Go v7.9.2 and v8.6.1. As a temporary workaround, chains can permission Channel Opening to prevent the vulnerable state from being introduced. For chains using ack-serializing middleware, updates must be made to use ibc-go's codec (transfertypes.ModuleCdc.[Must]MarshalJSON) for serialization. Chains with ack-serializing middlewares must perform coordinated upgrades rather than rolling updates (GitHub Advisory).

Community reactions

The vulnerability prompted extensive testing by the development team, including tests on packet-forward-middleware (PFM) v7 and v8, ibc-hooks v7 and v8, and live testing on mainnet nodes of both the Cosmos hub and Osmosis. An earlier patch was retracted and revised due to unexpected breakage in widely used middlewares (GitHub Advisory).