Research Summary
This report discusses a vulnerability in ibc-go, the reference implementation of the Interblockchain Communication Protocol (IBC) used by most Cosmos blockchains. The issue could lead to incorrect emission of Cosmos events triggered by a rolled-back IBC transfer. The vulnerability, codenamed Huckleberry, was privately disclosed to the Cosmos team and has been fixed. The report also highlights the importance of robust defense-in-depth mitigations in web3 applications.
Key Takeaways
IBC Vulnerability
- Incorrect Emission of Cosmos Events: The vulnerability in ibc-go could lead to the incorrect emission of Cosmos events triggered by a rolled-back IBC transfer. This could trick offchain applications into processing an operation that was never persisted.
- Broken Invariant in Cosmos Chains: The invariant was broken in all Cosmos chains with IBC support due to an incorrect error handling mechanism in ibc-go’s OnRecvPacket function.
- Event Emissions Despite Failed State Changes: Events generated during an IBC packet receive callback could end up in the final transaction results, even though their corresponding state changes were not persisted on chain.
Exploitation of the Vulnerability
- Targeting Trusting Events: An attacker exploiting these incorrect event emissions would need to identify a target that trusts events for sensitive actions and find a way to trigger the relevant events during the processing of an IBC packet, which will return a negative acknowledgment.
- Security Sensitive Offchain Applications: Centralized exchanges and bridges, which rely on Cosmos events, are examples of security sensitive offchain applications that could be exploited.
- Potential for Repeated Deposit Events: By exploiting the bug, an attacker could trigger repeated deposit events without losing control of the tokens.
Huckleberry Patch
- Simple Solution: The patch for Huckleberry is straightforward – don’t emit events for failed acknowledgments.
- Importance of Robust Defense: Vulnerabilities like Huckleberry highlight the need for robust defense-in-depth mitigations in web3 applications.
Actionable Insights
- Improving Security Measures: The discovery of the Huckleberry vulnerability underscores the need for improved security measures across the crypto ecosystem. This includes more rigorous testing and auditing of code, particularly for protocols that handle sensitive operations.
- Enhancing Error Handling Mechanisms: The incorrect error handling mechanism in ibc-go’s OnRecvPacket function that led to the vulnerability suggests that error handling mechanisms need to be enhanced to prevent similar issues in the future.
- Strengthening Offchain Applications: Given the potential for exploitation of offchain applications that rely on Cosmos events, these applications need to be strengthened to ensure they are not vulnerable to such attacks.
