{"id":"GHSA-2557-x9mg-76w8","aliases":["GO-2024-2571"],"status":"published","title":"ASA-2024-002: Default `PrepareProposalHandler` may produce invalid proposals when used with default `SenderNonceMempool`","description":"## ASA-2024-002: Default `PrepareProposalHandler` may produce invalid proposals when used with default `SenderNonceMempool`\n\n**Component**: Cosmos SDK\n**Criticality**: Medium\n**Affected** Versions: Cosmos SDK versions \u003c= 0.50.3; \u003c= 0.47.8\n**Affected** Users: Chain developers, Validator and Node operators\n**Impact**: Denial of Service\n\n## Summary\n\nWhen using the default `PrepareProposalHandler` and the default `SenderNonceMempool`, an issue was identified which may allow invalid blocks to be proposed when a single sender includes multiple transactions with non-sequential sequence numbers in certain conditions. If this state is reached, it can lead to a reduction in block production for a network.\n\n## Next Steps for Impacted Parties\n\nIf you are a chain developer on an affected version of the Cosmos SDK, it is advised to update to the latest available version of the Cosmos SDK for your project.  Once a patched version is available, it is recommended that network operators upgrade.\n\nA Github Security Advisory for this issue is available in the Cosmos-SDK [repository](https://github.com/cosmos/cosmos-sdk/security/advisories). For more information about Cosmos SDK, see https://docs.cosmos.network/.\n\nThis issue was found by [KonradStaniec](https://github.com/KonradStaniec), [gitferry](https://github.com/gitferry), [SebastianElvis](https://github.com/SebastianElvis), and [vitsalis](https://github.com/vitsalis) who reported it to the Cosmos Bug Bounty Program on HackerOne on January 16, 2024. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1285"],"published":"2024-02-21T00:13:46Z","modified":"2026-03-21T05:27:14Z","fixes":[{"ecosystem":"Go","package":"github.com/cosmos/cosmos-sdk","fixed_in":["0.50.4","0.47.9"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/cosmos/cosmos-sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.50.0"},{"last_affected":"0.50.3"},{"fixed":"0.50.4"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/cosmos/cosmos-sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.47.8"},{"fixed":"0.47.9"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cosmos/cosmos-sdk","ranges":[{"type":"SEMVER","events":[{"introduced":"0.50.0"},{"fixed":"0.50.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cosmos/cosmos-sdk","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.47.9"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cosmos/cosmos-sdk","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.47.9"},{"introduced":"0.50.0"},{"fixed":"0.50.4"}]}]}],"references":[{"url":"https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-2557-x9mg-76w8","tags":["web"]},{"url":"https://github.com/cosmos/cosmos-sdk/releases/tag/v0.47.9","tags":["web"]},{"url":"https://github.com/cosmos/cosmos-sdk/releases/tag/v0.50.4","tags":["web"]},{"url":"https://github.com/cosmos/cosmos-sdk/commit/c05850241e2d615721e3492d15fee4e1deec082b","tags":["web"]},{"url":"https://github.com/cosmos/cosmos-sdk/commit/fe32bcc1d65412c9b5737672956f0638c729ab7d","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-2557-x9mg-76w8","tags":["advisory"]},{"url":"https://github.com/cosmos/cosmos-sdk","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-2557-x9mg-76w8","title":"ASA-2024-002: Default `PrepareProposalHandler` may produce invalid proposals when used with default `SenderNonceMempool`","description":"## ASA-2024-002: Default `PrepareProposalHandler` may produce invalid proposals when used with default `SenderNonceMempool`\n\n**Component**: Cosmos SDK\n**Criticality**: Medium\n**Affected** Versions: Cosmos SDK versions \u003c= 0.50.3; \u003c= 0.47.8\n**Affected** Users: Chain developers, Validator and Node operators\n**Impact**: Denial of Service\n\n## Summary\n\nWhen using the default `PrepareProposalHandler` and the default `SenderNonceMempool`, an issue was identified which may allow invalid blocks to be proposed when a single sender includes multiple transactions with non-sequential sequence numbers in certain conditions. If this state is reached, it can lead to a reduction in block production for a network.\n\n## Next Steps for Impacted Parties\n\nIf you are a chain developer on an affected version of the Cosmos SDK, it is advised to update to the latest available version of the Cosmos SDK for your project.  Once a patched version is available, it is recommended that network operators upgrade.\n\nA Github Security Advisory for this issue is available in the Cosmos-SDK [repository](https://github.com/cosmos/cosmos-sdk/security/advisories). For more information about Cosmos SDK, see https://docs.cosmos.network/.\n\nThis issue was found by [KonradStaniec](https://github.com/KonradStaniec), [gitferry](https://github.com/gitferry), [SebastianElvis](https://github.com/SebastianElvis), and [vitsalis](https://github.com/vitsalis) who reported it to the Cosmos Bug Bounty Program on HackerOne on January 16, 2024. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.\n","status":"published","published":"2024-02-21T00:13:46Z","modified":"2026-03-21T05:27:14Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-1285"],"updated_at":"2026-11-02T14:39:40.633038Z"}],"osv":[{"id":"GHSA-2557-x9mg-76w8","title":"ASA-2024-002: Default `PrepareProposalHandler` may produce invalid proposals when used with default `SenderNonceMempool`","description":"## ASA-2024-002: Default `PrepareProposalHandler` may produce invalid proposals when used with default `SenderNonceMempool`\n\n**Component**: Cosmos SDK\n**Criticality**: Medium\n**Affected** Versions: Cosmos SDK versions \u003c= 0.50.3; \u003c= 0.47.8\n**Affected** Users: Chain developers, Validator and Node operators\n**Impact**: Denial of Service\n\n## Summary\n\nWhen using the default `PrepareProposalHandler` and the default `SenderNonceMempool`, an issue was identified which may allow invalid blocks to be proposed when a single sender includes multiple transactions with non-sequential sequence numbers in certain conditions. If this state is reached, it can lead to a reduction in block production for a network.\n\n## Next Steps for Impacted Parties\n\nIf you are a chain developer on an affected version of the Cosmos SDK, it is advised to update to the latest available version of the Cosmos SDK for your project.  Once a patched version is available, it is recommended that network operators upgrade.\n\nA Github Security Advisory for this issue is available in the Cosmos-SDK [repository](https://github.com/cosmos/cosmos-sdk/security/advisories). For more information about Cosmos SDK, see https://docs.cosmos.network/.\n\nThis issue was found by [KonradStaniec](https://github.com/KonradStaniec), [gitferry](https://github.com/gitferry), [SebastianElvis](https://github.com/SebastianElvis), and [vitsalis](https://github.com/vitsalis) who reported it to the Cosmos Bug Bounty Program on HackerOne on January 16, 2024. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.\n","status":"published","published":"2024-02-21T00:13:46Z","modified":"2024-05-23T18:32:11Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-1285"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"GO-2024-2571","title":"Invalid block proposal in github.com/cosmos/cosmos-sdk","description":"Invalid block proposal in github.com/cosmos/cosmos-sdk","status":"published","published":"2024-05-22T20:35:43Z","modified":"2024-05-23T16:09:24Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}