Cosmos EVM Flaw Exploited After Silent Patch Delay

For nearly four months, a critical flaw in the shared Cosmos EVM module sat unresolved after Cosmos Labs initially judged it harmless. That assessment proved wrong on a wide scale: between August 20 and August 25, 2026, attackers leveraged the bug to drain funds from six blockchains, according to a post-mortem published August 28 by Cosmos Labs.

A Critical Flaw, Initially Missed

The vulnerability, designated GHSA-7g4w-cg88-2cq2, was rated Critical by Cosmos Labs. It was published without a CVE identifier, a weakness classification, or a CVSS score. The affected versions are < 0.6.2 and >= 0.7.0 < 0.7.2, with fixes shipped in v0.6.2 and v0.7.2 on August 19. Chain operators were instructed to upgrade to those releases or later, a change that is state-breaking and requires a coordinated network upgrade.

Operators who could not upgrade immediately were advised to halt the chain rather than attempt a coordinated governance upgrade. The advisory also stated there is no configuration-only mitigation, and that disabling the staking precompile removes the primary trigger path but is not a substitute for the patch.

From "No Risk" to All Chains Affected

In its post-mortem, Cosmos Labs said the flaw was reported through its bug bounty program on April 25 and was assessed at the time as posing no risk to funds on live networks.

"We were unable to reproduce the vulnerability on 18-decimal networks and incorrectly concluded that it affected only non-18-decimal networks,"

— Cosmos Labs, in the post-mortem.

The team confirmed by August 13 that all Cosmos EVM chains were affected regardless of decimal configuration. The fix was then routed through the same public silent patch process the company reserves for issues that do not cause fund loss on production chains.

"At this point, for a vulnerability that is known to threaten user funds in production networks, the team would typically use secure channels to distribute a patch privately to the affected networks. Because the patch had already been publicly available on the main branch without known exploitation, the team concluded that it would be safe to proceed with the silent patch process," Cosmos Labs said.

Policy Contradiction

The company's own published silent patch policy sets a different course for a flaw of that class.

"When an issue presents an immediate or network-wide risk, Cosmos Labs will initiate emergency mitigations, private fix distribution, or coordinated upgrades before any public disclosure occurs," Cosmos Labs said in its bug bounty policy, last synced on July 27.

The policy statement appears to conflict with the actual handling of this vulnerability. After August 13, when all chains were known to be affected, the patch was still released publicly via the silent patch process rather than through private channels.

The Technical Root Cause

The flaw sits in the code that reconciles Ethereum Virtual Machine (EVM) state with the Cosmos SDK x/bank module. The EVM StateDB tracks only an account's spendable balance, while vesting accounts in SDK state hold both a spendable and a locked balance, and both x/staking and the staking precompile permit the locked portion to be delegated.

When a vesting account delegates more than its spendable balance, the post-delegation write-back subtracts the full delegated amount from the smaller spendable figure. The subtraction is unchecked, and the balance wraps to roughly 2^256.

Reconciliation then mints on a positive delta and burns on a negative one. The attacker can move a finite amount out of the wrapped account, or send a victim account 2^256 minus its balance so that reconciliation burns the victim's real holdings.

Chains on 0.6.x mint and burn on the backing SDK ledger, so a large mint causes a supply overflow that halts the chain. Chains running 0.7.x set balances directly in x/bank and accept changes that survive a uint256 to int256 conversion.

Both halves run inside a single transaction with a net supply change of zero, from a contract deployed onto a precomputed address that was first turned into a vesting account. Exploitation requires the chain to permit permissionless vesting-account creation.

Mitigation Steps for Operators

Operators running Cosmos EVM are advised to take several actions. The primary step is to upgrade to v0.6.2 or v0.7.2 or later, applying it as a coordinated network upgrade because the change is state-breaking. Operators who cannot upgrade at once are told to halt rather than vote: stop block production instead of running a coordinated governance upgrade.

Additionally, operators should close the precondition by rejecting MsgCreateVestingAccount, MsgCreatePermanentLockedAccount, and MsgCreatePeriodicVestingAccount in the ante handler. Vesting accounts defined in genesis are unaffected. They should also verify the live code path on a fork, because a cherry-pick that patches only the exported helper can leave a duplicated unexported copy in place while every test still passes.

Operators must apply the two fixes the advisory omits. The locked-balance snapshot and the module-account guard are separate changes, and the module-account guard rejects module accounts unconditionally, which breaks EVM calls made from a module account. Finally, they should register a security contact with Cosmos Labs, which learned of eleven Cosmos EVM deployments during the incident that had never registered with its security channels.

Two Extra Fixes Left Unnamed

The advisory documents one upstream change: the SubBalance underflow guard, merged to main on May 15 as pull request #1176 and backported on August 13. Two further balance fixes sit in the same repository and are named nowhere in it.

Pull request #1187, merged May 20, snapshots an account's locked balance so the bank balance is reconstructed correctly after a precompile changes it. Backports of #1187 to both release lines were opened the same day and merged within twenty-four hours, while the backport of #1176, an equally state-breaking change, followed about ninety days later.

Commit 3524ebc, titled "Merge commit from fork", rejects any attempt to set the balance of a module account.

Downstream Chaos

Downstream forks handled the situation differently. ZetaChain contributor morde08 said in a port of all three fixes published August 21 that the cherry-picked patch left the fork's live path unpatched, because the fork carried duplicate unexported helpers while the upstream change touched only the exported one.

Warden Protocol took the other route two days later and blocked vesting-account creation outright. "Vesting accounts are the only source of locked balances on Warden and nothing depends on users being able to create them, so removing that path closes the precondition rather than relying on the reconstruction being correct," Warden Protocol contributor jlehtimaki said in a commit message.

A public pull request in Push Chain's fork of Cosmos EVM described the vulnerability and its exploitation path in detail at 07:16 UTC on August 20, eight hours and fifteen minutes after the releases went out.

Timeline of the Exploit

The first attack, against MANTRA, began eleven hours and fifty minutes later at 19:06 UTC. Cosmos Labs sent its first private notification by secure email at 03:36 UTC on August 21, roughly two hours after MANTRA reported that it had been exploited.

"Cosmos Labs has released patches for 37 vulnerabilities silently in the last 13 months without downstream developers precisely describing exploit paths in public," Cosmos Labs said in the post-mortem.

The v0.6.2 and v0.7.2 release notes both state that the release contains important security fixes and should be applied as soon as possible, and both omit the security backport from their changelogs. The Hacker News confirmed on August 29 that neither release lists the pull requests carrying it.

Cosmos Labs said it is aware of six chains on which the exploit was leveraged.

• Attackers sold approximately USD 2.87 million in affected assets on decentralised exchanges based on August 19 prices, a figure the company said was supplied by the affected chains and has not been independently audited.
• A further USD 2.85 million was sold on centralised exchanges, an estimate Cosmos Labs based on publicly available volume data.
• The Cosmos ecosystem spans over 115 known public blockchains.

The Cost of a Silent Patch

The incident highlights the delicate balance between silent security fixes and transparent disclosure. Cosmos Labs initially judged the flaw harmless, then confirmed all chains were affected but still proceeded with a public silent patch. The consequence was that several chains were exploited before operators could act.

For blockchain operators, this means that relying on public patches without private advance notice can be perilous. The fact that the exploit was described in a public pull request hours before the first attack suggests that attackers may have been monitoring the public repository closely. This could raise the stakes for how Cosmos Labs and similar projects handle critical vulnerabilities in shared infrastructure, potentially pushing toward more private coordination even when the patch is already public.