-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2025-0002
============================================================

Advisory-ID:  0xCERT-2025-0002
Severity:     Critical
Published:    2025-10-21T18:04:34.000Z
Updated:      2026-10-08T22:48:24.383Z
Chains:       Cosmos Hub
URL:          https://www.0xcert.com/advisory/0xCERT-2025-0002

Title: Cosmos EVM Vulnerability

Summary
- -------
Cosmos EVM Vulnerability. Patched in versions v0.3.1, v0.4.2, and in the v0.5.0 release. More information will be disclosed at a later point to ensure chains have time to safely upgrade. No workarounds for chains that make use of static or dynamic precompiles.

Details
- -------
Summary
Patched in versions v0.3.1, v0.4.2, and in the v0.5.0 release. More information will be disclosed at a later point to ensure chains have time to safely upgrade. No workarounds for chains that make use of static or dynamic precompiles.

Affected
- - github.com/cosmos/evm (go) >= 0.3.0, < 0.3.2 — fixed in 0.3.2
- - github.com/cosmos/evm (go) >= 0.4.0, < 0.4.2 — fixed in 0.4.2

Severity
Critical, as rated by the upstream advisory.

Recommended actions
- - Upgrade github.com/cosmos/evm to 0.3.2 or later
- - Upgrade github.com/cosmos/evm to 0.4.2 or later

Source & attribution
This 0xCERT advisory summarises GHSA-8pfh-j44r-f654 from the GitHub Advisory Database: https://github.com/advisories/GHSA-8pfh-j44r-f654. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://github.com/advisories/GHSA-8pfh-j44r-f654
- - https://github.com/cosmos/evm/security/advisories/GHSA-8pfh-j44r-f654
- - https://github.com/cosmos/evm/commit/79089feebe79ce1f35250ba457cbd436e6bfff8b

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrIRikJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmeOFFg8HoZe5NIBRP5/QAHjgtT3FEyKCSXvnKXr
Q9svOxYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAACqFQD/WnG10RIW7g+8wslx
a1npztIicAZtNZ9slJ1x8x8W2lYA/1/9IZAq50nL0KTCMCU9P/aHT42N1nlN
ZnyNnmbqtaQK
=wU+3
-----END PGP SIGNATURE-----