Cosmos Labs Details Recent Attack on Cosmos EVM, Reveals Vulnerability Exploited Tokens

Cosmos Labs has published a post-mortem report on the recent attack against Cosmos EVM, revealing that six networks were vulnerable to exploitation. The attackers exploited a vulnerability in the code used by Cosmos EVM and Cosmos SDK to process token balances, allowing them to create an abnormal balance and then overflow it to steal legitimate tokens from another account.

The vulnerability was first reported on April 25th, but due to incorrect assumptions about its impact, Cosmos Labs chose not to disclose the details of the issue and instead applied a 'silent patch' to fix the problem. However, this decision backfired when an independent security researcher discovered the vulnerability again in early August.

Cosmos Labs has since acknowledged that all networks using Cosmos EVM were vulnerable, regardless of their decimal settings. The company has taken steps to address the issue, including applying patches and working with affected chains to stop network operations. In addition, they are reviewing their security processes and evaluation methods to prevent similar incidents in the future.