Session Fixation Affecting github.com/evmos/evmos/v18/precompiles/ics20 package, versions <18.1.0

Affected versions of this package are vulnerable to Session Fixation due to the improper handling of contract balances during interchain transactions involving a local state change and an ICS20 transfer. An attacker can exploit this flaw to artificially increase the supply of Evmos tokens by manipulating the sender parameter in the ICS20 transfer function. This is only exploitable if the contract address is used as the sender in an ICS20 transfer.

// This function does not reduce the contract balance correctly but liquid stakes correctly 
function transfer(
        string memory sourcePort,
        string memory sourceChannel,
        string memory denom,
        uint256 amount,
        string memory receiver,
        string memory evmosReceiver
    ) external returns (uint64 nextSequence) {
        counter += 1; # Only happens when there is a local state update together with an ICS20 Transfer
        Height memory timeoutHeight =  Height(100, 100);
        string memory memo = buildLiquidStakeMemo(receiver, evmosReceiver);
        return ICS20_CONTRACT.transfer(
            sourcePort, 
            sourceChannel,
            denom,
            amount,
            address(this), # this is the sender address which is the contract
            receiver,
            timeoutHeight,
            0,
            memo
        );
    }

• GitHub Commit