GHSA-83qr-9v2h-qxp4
Cosmos Hub (Gaia): The check for the height of cryptographic equivocation evidence is missing
Summary
An issue was identified in the Interchain Security (ICS) module that could result in the slashing of a validator for an "old" equivocation. The height-base filter for consumer equivocation evidence introduced in v2.4.0-lsm was re-enabled.
Details
ICS v2.4.0-lsm introduced a height-base filter for consumer equivocation evidence. This feature enables a provider to set per consumer chain minimum heights for which cryptographic evidence is considered valid. The Cosmos Hub v14 upgrade bumped ICS to v2.4.0-lsm and also set the minimum evidence height for both neutron-1 and stride-1 consumer chains to their respective height at that time (see PR). As a result, "older" cryptographic evidence was no longer accepted by the Hub.
The Cosmos Hub v15 upgrade bumped ICS to v3.3.3-lsm, which had the height-base filter for consumer equivocation evidence disabled.
What each source reports
GitHub AdvisoriesNo score
Cosmos Hub (Gaia): The check for the height of cryptographic equivocation evidence is missing
Summary
An issue was identified in the Interchain Security (ICS) module that could result in the slashing of a validator for an "old" equivocation. The height-base filter for consumer equivocation evidence introduced in v2.4.0-lsm was re-enabled.
Details
ICS v2.4.0-lsm introduced a height-base filter for consumer equivocation evidence. This feature enables a provider to set per consumer chain minimum heights for which cryptographic evidence is considered valid. The Cosmos Hub v14 upgrade bumped ICS to v2.4.0-lsm and also set the minimum evidence height for both neutron-1 and stride-1 consumer chains to their respective height at that time (see PR). As a result, "older" cryptographic evidence was no longer accepted by the Hub.
The Cosmos Hub v15 upgrade bumped ICS to v3.3.3-lsm, which had the height-base filter for consumer equivocation evidence disabled.
- Record
GHSA-83qr-9v2h-qxp4- Updated
- 2026-11-02
OSVGO-2024-3068No score
Missing check for the height of cryptographic equivocation evidence in github.com/cosmos/gaia
Missing check for the height of cryptographic equivocation evidence in github.com/cosmos/gaia
- Record
GO-2024-3068- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/cosmos/gaiaGo | Source text: > 14.2.0, < 17.3.0 | 17.3.0Not evaluated |
github.com/cosmos/gaia/v14Go | 14.2.0 and later | None known |
github.com/cosmos/gaia/v15Go | All versions | None known |
github.com/cosmos/gaia/v16Go | All versions | None known |
github.com/cosmos/gaia/v17Go | before 17.3.0 | 17.3.0 |
Not evaluated means the source gave git commits or a range we can't read, so we can't tell which releases are affected. A fixed version beside it is the source’s own claim.
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-83qr-9v2h-qxp4 is a vulnerability with no CVSS score yet in github.com/cosmos/gaia, published August 14, 2024. No source lists public exploit code. Fixed in github.com/cosmos/gaia/v17 17.3.0.