-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0222
============================================================

Advisory-ID:  0xCERT-2026-0222
Severity:     Critical
Published:    2026-03-11T14:53:51.000Z
Updated:      2026-10-08T22:48:27.263Z
Chains:       Cosmos Hub
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0222

Title: Cosmos EVM: incorrect state handling during nested EVM execution paths

Summary
- -------
Cosmos EVM: incorrect state handling during nested EVM execution paths. Advisory ID: ASA-2026-002 Component: ICS20 Precompile Status: Resolved Published: March 2026 Contact: security@cosmoslabs.io --- Status: Resolved. A patch is available and all known affected chains have either applied mitigations or upgraded.

Details
- -------
Summary
Advisory ID: ASA-2026-002 Component: ICS20 Precompile Status: Resolved Published: March 2026 Contact: security@cosmoslabs.io --- Status: Resolved. A patch is available and all known affected chains have either applied mitigations or upgraded.

Affected
- - github.com/cosmos/evm (go) < 0.6.0 — fixed in 0.6.0

Severity
Critical (CVSS 9.3), as rated by the upstream advisory.

Recommended actions
- - Upgrade github.com/cosmos/evm to 0.6.0 or later

Source & attribution
This 0xCERT advisory summarises GHSA-54gx-3cgr-7mfm from the GitHub Advisory Database: https://github.com/advisories/GHSA-54gx-3cgr-7mfm. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://github.com/advisories/GHSA-54gx-3cgr-7mfm
- - https://github.com/cosmos/evm/security/advisories/GHSA-54gx-3cgr-7mfm
- - https://github.com/cosmos/evm/releases/tag/v0.6.0

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrI9SUJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmc2Sq903t9QRI0FGwoALa4vTknFQ1pBUx7ybGU5
5S5O9BYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAAP/gEAj9gqkEYSiYtlSWD1
unC7pPXmXzVDFl2s3C+q4zYXQ5sBAKVFdZFsxMpeHMh2gigndsYM0E7bpPY2
0PRTNphdYH8I
=FUxO
-----END PGP SIGNATURE-----