Incidents and Security Advisories
A durable record of chain halts, liveness failures, state-breaking bugs, disclosed vulnerabilities, and cross-chain exploit events such as those involving IBC hooks or Interchain Accounts. Security engineers, incident responders, and risk teams use this group for root cause analysis, patch verification, and assessing the blast radius of vulnerabilities across the interchain. This group combines operational incidents and security disclosures because both demand immediate remediation and post-mortem review.
2024-06-17 Cosmos Hub v17 LSM Halt
Root cause analysis of the Gaia v17 chain halt triggered by a bug in the Liquid Staking Module. Covers the state-breaking condition, the coordinated v17.1 patch, validator upgrade procedures, and impact on exchanges and staking providers. Chainscore can assist teams with upgrade readiness review and post-halt state validation.
2023-06-07 IBC Hooks Reentrancy Exploit
Technical deep dive into the critical IBC Hooks middleware vulnerability exploited on Osmosis. Analyzes the flawed OnRecvPacket reentrancy path, the exploit transaction flow, and the emergency patch. Security engineers and appchain developers need to verify their IBC middleware compositions. Chainscore offers integration review for chains using IBC Hooks.
2022-10-13 BNB Smart Chain IBC/CometBFT Exploit
Case study of the BNB Chain cross-chain bridge exploit involving IBC and CometBFT proof verification vectors. Relevant for all IBC-connected chains assessing proof verification security. Chainscore provides bridge security assessments and incident pattern analysis for interchain infrastructure teams.
2022-05-08 Terra IBC Liveness Failure
Examination of the Terra Classic chain halt and IBC liveness failure following the UST de-peg. Focuses on validator overload, cross-chain communication breakdown, and systemic risk to IBC-connected chains during extreme volatility. Risk teams should review relayer and validator scaling limits. Chainscore can help model IBC failure modes under stress.
2021-02-18 Cosmos Hub Stargate Upgrade Incident
Post-mortem of the unexpected halt after the Stargate upgrade caused by a non-deterministic bug in the IAVL library. Covers the emergency patch, state export/import recovery, and lessons for future breaking changes. Node operators and upgrade coordinators should review state migration procedures. Chainscore offers upgrade readiness and state validation support.
ASA-2024-001: IBC-Go Client State Expiry Panic
Technical record of a vulnerability where a malicious IBC packet could trigger a node or relayer panic via client state expiry logic. Covers affected IBC-Go versions, the patch diff, and verification steps. Relayer operators and chain teams must verify their IBC-Go version. Chainscore can assist with patch verification and impact assessment.
ASA-2023-002: Cosmos SDK x/group Module Reentrancy
Disclosure of a state-breaking reentrancy vulnerability in the x/group module allowing fund drainage or state corruption. Details the vulnerable execution path and patched handler logic. Appchains using x/group must verify their SDK version. Chainscore provides smart contract and module review for affected chains.
ASA-2022-003: Dragonberry IBC-Go Security Advisory
Canonical record of the critical Dragonberry vulnerability in IBC-Go affecting all IBC-connected chains. Covers the trust assumption violation in the ICA host module that could allow a malicious controller chain to steal funds. Chain teams must verify their IBC-Go version and ICA host configurations. Chainscore offers cross-chain security review and remediation planning.
ASA-2021-001: Tendermint Light Client Amnesia Attack
Analysis of a theoretical but critical vulnerability in the Tendermint light client verification algorithm where a validator set with amnesia could forge a valid light block. Explains the patch introducing a new verification predicate. IBC light client implementers should review their verification logic. Chainscore can assist with light client security audits.
IBC-Go Huckleberry Patch Analysis
Technical breakdown of the Huckleberry security patch for IBC-Go addressing multiple medium-severity issues in packet timeouts and acknowledgments. Covers denial-of-service prevention and relayer impact. Relayer operators and chain teams should verify their IBC-Go version. Chainscore provides patch impact assessment and upgrade planning.
IBC Token Voucher Impersonation Attack Pattern
Pattern-based analysis of exploits where a malicious chain or relayer forges IBC token voucher denominations to mint counterfeit assets. Covers ICS-20 validation logic and prevention methods. Exchange integration teams and appchain developers should review their token denomination validation. Chainscore offers IBC integration security review.
Interchain Accounts Host Chain Takeover Vectors
Examination of systemic risk patterns where a compromised controller chain uses open ICA channels to execute arbitrary transactions on a host chain. Covers governance and vault drainage scenarios. ICA host chains should review their channel authorization logic. Chainscore provides ICA security assessment and blast radius analysis.
Relayer Incentive Manipulation and Packet Spamming
Analysis of denial-of-service patterns where attackers flood IBC channels with timeout or garbage packets to exhaust relayer funds. Covers transaction censorship and cross-chain traffic delays. Relayer operators should review their fee models and rate limiting. Chainscore can assist with relayer resilience testing and monitoring design.
Light Client Freeze and Unbonding Race Conditions
Deep dive into exploit patterns manipulating the trust period and unbonding period of IBC light clients. Covers fork finalization attacks before equivocation detection. Chain teams should review their light client parameters. Chainscore offers light client security review and parameter recommendation.
Governance-Triggered State Machine Replay Attacks
Analysis of patterns where chain upgrades or governance proposals inadvertently reset IBC packet sequences, allowing settled packets to be replayed. Covers state machine version migration risks. Upgrade coordinators should review packet sequence handling during migrations. Chainscore provides upgrade impact review and state migration validation.
Non-Deterministic State Machine Halts
Recurring pattern analysis of chain halts caused by non-determinism in the Cosmos SDK state machine. Covers floating-point operations, map iteration, and concurrency bugs in modules like IAVL. Appchain developers should review their module determinism. Chainscore offers state machine determinism audits.
Validator Liveness Cascade Failures
Analysis of incidents where a critical mass of validators simultaneously lose liveness due to cloud provider outages, peering misconfigurations, or resource exhaustion. Covers chain halt and coordinated restart procedures. Validator operators should review their infrastructure diversity. Chainscore can assist with validator resilience planning.
State Sync and Snapshot Corruption Events
Guide to incidents where invalid or malicious state snapshots cause nodes to sync to a false chain state. Covers detection methods and impact on RPC providers and exchanges. Node operators should verify snapshot integrity. Chainscore provides node operation security review and monitoring design.
Mempool Congestion and Transaction Eviction Attacks
Analysis of operational incidents where misconfigured or malicious mempool policies cause network-wide congestion and transaction eviction. Covers liveness failure for DeFi protocols. Validator operators should review their mempool configurations. Chainscore offers mempool policy review and congestion monitoring design.
Coordinated Chain Restart After State-Breaking Bug
Practical playbook for validators and node operators on emergency chain halt coordination, pre-bug state export, patch application, and network restart with minimal data loss. Incident responders should have this procedure documented and tested. Chainscore provides incident response planning and tabletop exercise facilitation.
IBC Channel Closure and Fund Recovery Protocol
Step-by-step guide for security teams on using governance proposals to force-close compromised IBC channels, freeze token vouchers, and initiate recovery for stranded or stolen assets. Governance participants and security teams should understand this procedure. Chainscore offers incident response support and recovery coordination.
Verifying and Applying Emergency Security Patches
Checklist for incident responders on independently verifying emergency patch binary integrity, assessing blast radius, and deploying under time pressure. Node operators and security teams should have this process documented. Chainscore provides patch verification and deployment planning support.
Cross-Chain Incident Communication and Blast Radius Assessment
Framework for security teams to map vulnerability blast radius across the interchain, identify all affected chains and channels, and coordinate synchronized disclosure and remediation. Interchain security teams should adopt this framework. Chainscore offers cross-chain incident coordination and impact assessment.