Cosmos Labs recommended on Tuesday that any public blockchain running a version of its Cosmos EVM module below v0.6.2 or v0.7.2 "immediately halt the blockchain and upgrade it to include the patches in those releases." The post went up at 11:19 a.m. New York time and asked teams without shared security contacts to write to security@cosmoslabs.io "to receive critical updates."
The recommendation reaches an unknown number of networks that share one open-source codebase. Three chains running it — MANTRA, TAC and KiiChain — were attacked between Aug. 20 and Aug. 22, and two are still frozen. Cosmos Labs has published no security advisory for the flaw.
KiiChain has put the only numbers on the damage. An attacker drained 148 million KII from wallets on the chain on Aug. 22, "repeating the same technique 18 times against different targets," the team said in an incident report published Aug. 24. That is worth roughly $9.7 million at the $0.0653 KII traded at 21:00 UTC that day, per CoinGecko. KiiChain halted the network at block 9,355,723, timestamped 22:50:58 UTC. A public node showed that block still as the chain tip on Tuesday afternoon, 66 hours later.
- About 80.7 million KII, or 54.4%, sits in attacker addresses the halt immobilized and will be moved to recovery wallets at restart.
- 67.6 million KII was bridged to BNB Smart Chain through Hyperlane, where 64.6 million was sold on decentralized exchanges for roughly 1.61 million BUSD.
- 3 million KII went to a KuCoin deposit address; KiiChain said "confirmation is still pending" on whether it can be recovered.
"The vulnerability is in Cosmos code, not KiiChain code," the report said. Three upstream defects had to line up: an underflow in the staking precompile when it writes a post-delegation balance back to the EVM, plus two bugs KiiChain says are still undisclosed. The chain runs the module unmodified.
An ordinary wallet cannot reach the flaw, because it cannot delegate more than it can spend. KiiChain says the attacker computed the address its exploit contract would deploy to, converted that address into a vesting account, then deployed the contract onto it. The contract inherited vesting status, delegated one wei more than its spendable balance, and underflowed its mirrored EVM balance to roughly 2^256. Total supply was never inflated, and each drain was capped at the victim's real balance. Any Cosmos EVM chain with vesting accounts enabled carries the same exposure, according to the report, "which is why Mantra and TAC were compromised the same week by the same class of attack."
Disclosure timeline disputed
KiiChain's report accuses Cosmos Labs of handling the disclosure in a way that created the window it was robbed in. Cosmos Labs published a fix for one of the three defects in a public repository on Wednesday, Aug. 19, the report said. "Publishing a security fix in the open, before the chains running that code have been told privately and given time to patch, hands the vulnerability to anyone reading the commit. Standard responsible disclosure exists precisely to prevent this." Cosmos Labs "gave no advance notice to downstream chains, did not flag the release as security critical, and did not tell affected chains that a public release had happened until Friday 21 August, two days later," the report said.
The halt recommendation, according to KiiChain, "was not made until Saturday 22 August, after Mantra, TAC and KiiChain had all been compromised." The report argues that instruction mattered more than the code: "A patch takes days to review, build, test and roll out across a validator set. A halt takes minutes."
The v0.6.2 and v0.7.2 release notes name a pull request that moves test deployments off module accounts, and the changelog at both tags spells out what changed: "contract creation bumps the sender's nonce, SetAccount persists nonce and balance together, and the EVM commit path may not write a module account's balance."
Source: The Defiant
