{"id":"GHSA-83qr-9v2h-qxp4","aliases":["GO-2024-3068"],"status":"published","title":"Cosmos Hub (Gaia): The check for the height of cryptographic equivocation evidence is missing","description":"### Summary \n\nAn issue was identified in the Interchain Security (ICS) module that could result in the slashing of a validator for an \"old\" equivocation. The height-base filter for consumer equivocation evidence introduced in [v2.4.0-lsm](https://github.com/cosmos/interchain-security/releases/tag/v2.4.0-lsm) was re-enabled. \n\n### Details \n\nICS [v2.4.0-lsm](https://github.com/cosmos/interchain-security/releases/tag/v2.4.0-lsm) introduced a height-base filter for consumer equivocation evidence. This feature enables a provider to set per consumer chain minimum heights for which cryptographic evidence is considered valid. The Cosmos Hub [v14 upgrade](https://github.com/cosmos/gaia/releases/tag/v14.1.0) bumped ICS to v2.4.0-lsm and also set the minimum evidence height for both `neutron-1` and `stride-1` consumer chains to their respective height at that time (see [PR](https://github.com/cosmos/gaia/pull/2821)). As a result, \"older\" cryptographic evidence was no longer accepted by the Hub.\n\nThe Cosmos Hub [v15 upgrade](https://github.com/cosmos/gaia/releases/tag/v15.1.0) bumped ICS to [v3.3.3-lsm](https://github.com/cosmos/interchain-security/releases/tag/v3.3.3-lsm), which had the height-base filter for consumer equivocation evidence disabled.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2024-08-14T17:54:38Z","modified":"2026-03-03T04:55:42Z","fixes":[{"ecosystem":"Go","package":"github.com/cosmos/gaia","fixed_in":["17.3.0"],"sources":["ghsa"]},{"ecosystem":"Go","package":"github.com/cosmos/gaia/v17","fixed_in":["17.3.0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/cosmos/gaia","ranges":[{"type":"UNPARSED","raw":"\u003e 14.2.0, \u003c 17.3.0","events":[{"fixed":"17.3.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cosmos/gaia/v14","ranges":[{"type":"SEMVER","events":[{"introduced":"14.2.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cosmos/gaia/v15","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cosmos/gaia/v16","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cosmos/gaia/v17","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"17.3.0"}]}]}],"references":[{"url":"https://github.com/cosmos/gaia/security/advisories/GHSA-83qr-9v2h-qxp4"},{"url":"https://github.com/advisories/GHSA-83qr-9v2h-qxp4","tags":["advisory"]}],"sources":{"ghsa":[{"id":"GHSA-83qr-9v2h-qxp4","title":"Cosmos Hub (Gaia): The check for the height of cryptographic equivocation evidence is missing","description":"### Summary \n\nAn issue was identified in the Interchain Security (ICS) module that could result in the slashing of a validator for an \"old\" equivocation. The height-base filter for consumer equivocation evidence introduced in [v2.4.0-lsm](https://github.com/cosmos/interchain-security/releases/tag/v2.4.0-lsm) was re-enabled. \n\n### Details \n\nICS [v2.4.0-lsm](https://github.com/cosmos/interchain-security/releases/tag/v2.4.0-lsm) introduced a height-base filter for consumer equivocation evidence. This feature enables a provider to set per consumer chain minimum heights for which cryptographic evidence is considered valid. The Cosmos Hub [v14 upgrade](https://github.com/cosmos/gaia/releases/tag/v14.1.0) bumped ICS to v2.4.0-lsm and also set the minimum evidence height for both `neutron-1` and `stride-1` consumer chains to their respective height at that time (see [PR](https://github.com/cosmos/gaia/pull/2821)). As a result, \"older\" cryptographic evidence was no longer accepted by the Hub.\n\nThe Cosmos Hub [v15 upgrade](https://github.com/cosmos/gaia/releases/tag/v15.1.0) bumped ICS to [v3.3.3-lsm](https://github.com/cosmos/interchain-security/releases/tag/v3.3.3-lsm), which had the height-base filter for consumer equivocation evidence disabled. \n","status":"published","published":"2024-08-14T17:54:38Z","modified":"2024-08-14T17:54:39Z","updated_at":"2026-11-02T14:37:59.336921Z"}],"osv":[{"id":"GO-2024-3068","title":"Missing check for the height of cryptographic equivocation evidence in github.com/cosmos/gaia","description":"Missing check for the height of cryptographic equivocation evidence in github.com/cosmos/gaia","status":"published","published":"2024-08-19T17:26:34Z","modified":"2026-03-03T04:55:42.640824Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}