Cosmos 区块链漏洞已修复，防止潜在的 1.5 亿美元黑客攻击

Wormhole 协议的贡献者 Asymmetry Research 在 Cosmos 区块链生态系统中发现了一个“重入漏洞”，该漏洞可能导致超过 1.5 亿美元的损失。据 Cosmos 漏洞赏金计划运营商 Asymmetry 和 Amulet 称，尽管该漏洞很严重，但在任何利用行为发生之前，该漏洞已被私下披露并进行了修补。

Cosmos Blockchain Bug Patched, Preventing Potential $150 Million Loss

Cosmos 区块链漏洞已修复，避免了 1.5 亿美元的潜在损失

Asymmetric Research, a security firm actively contributing to the Wormhole interoperability protocol, has uncovered a critical vulnerability within the Cosmos blockchain ecosystem. This reentrancy bug, if exploited, could have potentially compromised over $150 million worth of digital assets.

Asymmetry Research 是一家积极为 Wormhole 互操作性协议做出贡献的安全公司，它发现了 Cosmos 区块链生态系统中的一个关键漏洞。这种重入漏洞如果被利用，可能会损害价值超过 1.5 亿美元的数字资产。

Prompt Action Averts Disaster

及时采取行动避免灾难

Asymmetric responsibly disclosed the vulnerability to the Cosmos development team, who promptly addressed the issue before any malicious actors could take advantage. "We privately disclosed the vulnerability through the Cosmos HackerOne Bug Bounty program and the issue is now patched," Asymmetric stated in an official release. "No malicious exploitation took place and no funds were lost."

Asym 负责任地向 Cosmos 开发团队披露了该漏洞，后者在任何恶意行为者利用之前立即解决了该问题。 “我们通过 Cosmos HackerOne Bug Bounty 计划私下披露了该漏洞，该问题现已得到修复，”Asymmetry 在一份官方新闻稿中表示。 “没有发生恶意利用，也没有资金损失。”

Jessy Irwin, CEO of Amulet, an organization contracted by the Interchain Foundation to oversee the bug bounty program and coordinate security for the Cosmos ecosystem, confirmed the report and the subsequent release of an advisory notice.

Amulet 是 Interchain 基金会签约的组织，负责监督漏洞赏金计划并协调 Cosmos 生态系统的安全性，其首席执行官 Jessy Irwin 证实了该报告以及随后发布的咨询通知。

A First for Cosmos

Cosmos 的首次

The Cosmos ecosystem encompasses a network of blockchains that share common code and core modules. While no funds were lost due to this bug, its discovery marks a significant milestone for the ecosystem. It represents the first instance of a reentrancy vulnerability being identified within Cosmos, a platform widely regarded as one of the most secure blockchain technologies.

Cosmos 生态系统包含共享通用代码和核心模块的区块链网络。虽然这个错误没有造成任何资金损失，但它的发现标志着生态系统的一个重要里程碑。它代表了 Cosmos 中发现的第一个可重入漏洞的实例，Cosmos 是一个被广泛认为是最安全的区块链技术之一的平台。

Inter-Blockchain Communication Vulnerability

区块链间通信漏洞

A key component of most Cosmos chains is the Inter-Blockchain Communication Protocol (IBC), a technology facilitating seamless communication and asset transfer between blockchains. Asymmetric's vulnerability discovery was specifically within ibc-go, a reference implementation of IBC utilized by numerous Cosmos chains.

大多数 Cosmos 链的关键组成部分是区块链间通信协议（IBC），这是一种促进区块链之间无缝通信和资产转移的技术。 Asymmetry 的漏洞特别是在 ibc-go 中发现的，ibc-go 是众多 Cosmos 链所使用的 IBC 参考实现。

"During the investigation of this issue, both Amulet and the IBC-go team independently assessed the potential impact to identify parties at risk and mitigate the severity," Irwin explained.

“在调查此问题期间，Amulet 和 IBC-go 团队都独立评估了潜在影响，以确定面临风险的各方并减轻严重程度，”Irwin 解释道。

Infinite Token Minting Threat

无限的代币铸造威胁

The vulnerability, categorized as a reentrancy bug, theoretically enabled an attacker to mint an infinite number of tokens on IBC-connected chains such as Osmosis, which hosts one of the largest decentralized finance (DeFi) ecosystems on Cosmos.

该漏洞被归类为可重入漏洞，理论上使攻击者能够在 IBC 连接的链上铸造无限数量的代币，例如 Osmosis，它托管着 Cosmos 上最大的去中心化金融 (DeFi) 生态系统之一。

"While this vulnerability has been present in ibc-go since its inception, it only became exploitable due to recent developments in the Cosmos SDK ecosystem," Asymmetric revealed in a blog post. The vulnerability was triggered by the emergence of "IBC middleware," third-party applications built using CosmWasm, a WebAssembly-based smart contract runtime, that enables cross-blockchain token usage.

“虽然这个漏洞自 ibc-go 诞生以来就存在，但由于 Cosmos SDK 生态系统的最新发展，它才变得可利用，”Asymmetry 在一篇博客文章中透露。该漏洞是由“IBC 中间件”的出现触发的，“IBC 中间件”是使用 CosmWasm 构建的第三方应用程序，CosmWasm 是一种基于 WebAssembly 的智能合约运行时，可实现跨区块链代币使用。

Highlighting Cross-Chain Security Risks

凸显跨链安全风险

"This vulnerability emphasizes the urgent need for intensified research into cross-chain security risks to safeguard the multichain ecosystem," remarked Jonathan Claudius, CEO of Asymmetric and former security chief at venture firm Jump Crypto. "This case demonstrates our commitment to identifying and neutralizing existential threats that could jeopardize the digital economy."

Asymmetry 首席执行官、风险投资公司 Jump Crypto 前安全主管 Jonathan Claudius 表示：“这一漏洞强调了加强对跨链安全风险研究的迫切需要，以保护多链生态系统。” “这个案例表明我们致力于识别和消除可能危及数字经济的生存威胁。”

Conclusion

结论

The swift and effective response by Asymmetric Research and the Cosmos development team averted a potentially catastrophic loss of funds within the Cosmos blockchain ecosystem. This incident highlights the importance of continuous vulnerability monitoring and responsible disclosure practices within the blockchain industry. It also underscores the need for ongoing research into cross-chain security risks to ensure the resilience and security of the evolving multichain ecosystem.

Asymmetry Research 和 Cosmos 开发团队迅速而有效的响应避免了 Cosmos 区块链生态系统内潜在的灾难性资金损失。这一事件凸显了区块链行业持续漏洞监控和负责任的披露实践的重要性。它还强调需要持续研究跨链安全风险，以确保不断发展的多链生态系统的弹性和安全性。