Cosmos

Cosmos 的公开漏洞报告、类别分布与常见资产。

攻击面

弱点类别分布

• 业务逻辑4
• 访问控制2
• 拒绝服务2
• 内存破坏2
• 其他弱点1

主要弱点

• 业务逻辑错误3
• 资源消耗失控2
• 权限提升1
• Unlabeled1
• Unlabeled1
• 缓冲区越界读1
• Unlabeled1
• 访问控制缺陷（通用）1

常见资产

• https://github.com/cometbft/cometbftSOURCE_CODE · 2
• Cosmos SDKOTHER · 2
• CosmWasmOTHER · 2
• ibc-goOTHER · 2
• https://github.com/cosmos/ledger-cosmosSOURCE_CODE · 1
• www.github.com/cosmos/evmSOURCE_CODE · 1
• CometBFTOTHER · 1

高票报告

当前状态 11 份 · 全部 11

1. 91
   Groups module can halt chain when handling a proposal with malicious group weights其他弱点 · 2025-04-24 · 高危
   $15,000Unlabeled
2. 81
   Unauthorized coins transfer from locking account(s)访问控制 · 2025-06-29 · 严重
   $0访问控制缺陷（通用）
3. 81
   Attacker can use any non-enabled capability访问控制 · 2025-01-16 · 低危
   $2,000权限提升
4. 61
   Race condition in faucet when using starport业务逻辑 · 2022-07-27 · 严重
   $5,000Unlabeled
5. 47
   Memory Exhaustion in CometBFT v1.0.1 via malicious ProposalMessage leads to network-wide denial of service内存破坏 · 2026-01-20 · 未评级
   $0Unlabeled
6. 34
   Heap-Buffer-Overread in contains_whitespace when calling parser_validate after supplying a maliciously crafted buffer to parser_parse内存破坏 · 2024-11-19 · 未评级
   $2,000缓冲区越界读
7. 27
   Unclaimed official s3 bucket of tendermint(tendermint-packages) which is used by many other blockchain companies in their code业务逻辑 · 2023-02-16 · 低危
   $0业务逻辑错误
8. 26
   Making transfer v2 channel unupgradable through the forwarding业务逻辑 · 2025-06-30 · 低危
   $0业务逻辑错误
9. 22
   Replacing ICA active channel during the upgrade and a bit more业务逻辑 · 2025-06-30 · 低危
   $0业务逻辑错误
10. 16
    Economic DoS (Griefing) on IBC Relayers via `memo` Callback Gas Exploitation拒绝服务 · 2025-12-19 · 高危
    $0资源消耗失控
11. 9
    IBC2 Entry Points Skip SetupContractCost - Systematic Gas Underpricing拒绝服务 · 2026-10-20 · 中危
    $0资源消耗失控