GHSA-79xg-q4qm-7v9w

# CWA-2025-006: Improper error handling may lead to IBC channel opening despite error

**Severity**

High (Considerable + Likely)[^1]

**Affected versions:**

- wasmd 0.60.0 - wasmd >= 0.51.0 < 0.55.1

**Patched versions:**

- wasmd 0.60.1, 0.55.1, 0.54.1, 0.53.3

## Description of the bug

A contract erroring during IBC channel opening does not prevent the channel from opening.

## Applying the patch

The patch will be shipped in a wasmd release. You will also have to update `libwasmvm` if you build statically. If you already use the latest / close to latest wasmd, you can update more or less as follows:

1. Check the current wasmd version: `go list -m github.com/CosmWasm/wasmd` 2. Bump the `github.com/CosmWasm/wasmd` dependency in your go.mod to 0.60.1 (Cosmos SDK 0.53 compatible), 0.55.1 (Cosmos SDK 0.50 compatible), 0.54.1 or 0.53.3; `go mod tidy`; commit. 3. If you use the static libraries `libwasmvm_muslc.aarch64.a`/`libwasmvm_muslc.x86_64.a`, make sure that you use the same version as your wasmvm version. 4. Check the updated wasmd version: `go list -m github.com/CosmWasm/wasmd` and ensure you see 0.60.1, 0.55.1, 0.54.1 or 0.53.3. 5. Follow your regular practices to deploy chain upgrades.

The patch is consensus breaking.

## Acknowledgement

This problem was discovered during an audit of the CosmWasm stack performed by Sherlock and funded by ICF/ICL in Q1 2025. Thank you for that work!

If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see <https://hackerone.com/cosmos>.

## Timeline

- 2025-03-03: Auditor informs Confio about this issue. - 2025-04-10: Confio developed the patch internally. - 2025-06-05: Upcoming patch is announced. - 2025-06-10: Patch is released.

[^1]: following Amulet's Severity Classification Framework ACMv1.2: <https://github.com/interchainio/security/blob/0295254e8645301ccb606d46108a45cede0a73e0/resources/CLASSIFICATION_MATRIX.md>