GHSA-v6rw-hhgg-wc4x: 
vulnerability analysis and mitigation

A critical severity vulnerability (GHSA-v6rw-hhgg-wc4x) was discovered in Evmos versions below v11.0.1, affecting the blockchain's transaction processing mechanism. The vulnerability was disclosed on April 17, 2024, impacting the Evmos blockchain platform. The issue stems from the system's failure to properly check MsgEthereumTx messages nested under other messages, potentially allowing malicious actors to bypass critical security checks (GitHub Advisory).

The vulnerability received a CVSS score of 9.1 (Critical), with base metrics indicating network attack vector, low attack complexity, no privileges required, and no user interaction needed. The technical assessment shows that while the vulnerability doesn't affect confidentiality, it has high impact on both integrity and availability. The issue specifically relates to the newEthAnteHandler's security checks being bypassed when MsgEthereumTx messages are nested under other messages (GitHub Advisory).

The vulnerability affects all Evmos users by potentially rendering the chain unusable during an attack. While users' funds and chain state remain secure, the vulnerability can lead to a complete chain halt. The impact is particularly severe as it allows attackers to bypass block gas limits and gas payment mechanisms, enabling a full Denial-of-Service attack against the chain (GitHub Advisory).

The attack vector involves deploying a smart contract containing an infinite loop to the chain, followed by calling this contract using an embedded transaction with an extremely high gas value (uint64 max or similar). When such a transaction is included in a block, nodes attempt to execute the EVM transaction with almost infinite gas, causing them to become stuck. This results in the cessation of new block creation and effectively halts the chain, necessitating a manual restart of all nodes (GitHub Advisory).

The vulnerability has been patched in Evmos versions ≥v12.0.0. The fix implements an AuthzLimiterDecorator for both Cosmos and EIP-712 transactions, which blocks MsgEthereumTxs messages from being sent under the authz module's MsgExec message. The solution includes a recursive check over nested messages of MsgExec and limits the number of possible nested messages. This implementation requires a hard-fork upgrade due to its state machine-breaking nature (GitHub Advisory).