—

RUSTSEC-2024-0361

CWA-2024-004: Gas mispricing in cosmwasm-vm

Details

Some Wasm operations take significantly more gas than our benchmarks indicated. This can lead to missing the gas target we defined by a factor of ~10x. This means a malicious contract could take 10 times as much time to execute as expected, which can be used to temporarily DoS a chain.

For more information, see [CWA-2024-004](https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2024-004.md).

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/cosmwasm-vm

Introduced in: 0.0.0-0Fixed in: 1.5.7

Upgrade cosmwasm-vm to 1.5.7 or newer (ecosystem crates.io).

References

https://crates.io/crates/cosmwasm-vm[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2024-0361.html[ADVISORY]
https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2024-004.md[ADVISORY]