Always-Incorrect Control Flow Implementation Affecting github.com/cosmos/evm/precompiles/ics20 package, versions <0.6.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMCOSMOSEVMPRECOMPILESICS20-15626797
- published15 Mar 2026
- disclosed11 Mar 2026
- creditSaga, Sherlock, B-Harvest, Mantra, Zellic
Introduced: 11 Mar 2026
CVE NOT AVAILABLE CWE-670 (opens in a new tab)How to fix?
Upgrade github.com/cosmos/evm/precompiles/ics20 to version 0.6.0 or higher.
Overview
Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation due to incorrect state handling in nested execution paths involving the ICS20 precompile. An attacker can repeatedly utilize the same token balance within a single transaction by exploiting recursive calls where state updates are not properly reflected in the outer execution context, potentially resulting in unauthorized asset transfers and financial loss. This is only exploitable if the ICS20 precompile is enabled in the affected environment.
Workaround
This vulnerability can be mitigated by disabling the ICS20 precompile.