Skip to content

Modification of validator set from two modules halts the chain

High
KonradStaniec published GHSA-rj53-j6jw-7f7g Jul 7, 2025

Package

No package listed

Affected versions

>= 2.0.0, <2.1.0

Patched versions

2.1.0

Description

Summary

Sending a message that modifies the validator set at the epoch boundary halts the chain.

Impact

Denial of Service - Comos-sdk prevents modifying the validator set from two different modules - https://github.com/cosmos/cosmos-sdk/blob/release/v0.50.x/types/module/module.go#L811. Such an operation leads to panic and chain halt.

Detailed Post mortem

https://boiling-lake-106.notion.site/2025-06-18-Genesis-mainnet-chain-halt-post-mortem-229f60cc1b5f80b7adf5e3ea0541ea87

Severity

High

CVE ID

No known CVE

Weaknesses

No CWEs