GO-2024-2638
ValidateVoteExtensions function in Cosmos SDK may allow incorrect voting power assumptions in github.com/cosmos/cosmos-sdk
Quick fix
GO-2024-2638 — github.com/cosmos/cosmos-sdk: upgrade to the fixed version with the command below.
go get github.com/cosmos/cosmos-sdk@v0.50.5Details
The default ValidateVoteExtensions helper function infers total voting power based on the injected VoteExtension, which are injected by the proposer.
If your chain utilizes the ValidateVoteExtensions helper in ProcessProposal, a dishonest proposer can potentially mutate voting power of each validator it includes in the injected VoteExtension, which could have potentially unexpected or negative consequences on modified state. Additional validation on injected VoteExtension data was added to confirm voting power against the state machine.
Are you affected?
Enter the version of the package you're using.
Affected packages
0.50.0Fixed in: 0.50.5go get github.com/cosmos/cosmos-sdk@v0.50.5