ZetaChain Disclosed Report

https://github.com/zeta-chain/go-tss

Summary

A critical vulnerability has been identified in ZetaChain, an EVM-compatible L1 blockchain that connects various ecosystems, originating from its reliance on the Cosmos SDK. This issue enables unsafe transaction decoding, which can lead to stack overflow (ASA-2024-0012) or resource exhaustion (ASA-2024-0013). Exploiting this flaw could disrupt ZetaChain’s node software, impacting network consensus, internal transactions, cross-chain functionality, and staking operations.

---

Finding Description

Vulnerability 1: ASA-2024-0012 (Stack Overflow)

• Description: ZetaChain’s usage of Cosmos SDK inherits a vulnerability where deeply nested packets during decoding can trigger a stack overflow. Without enforced recursion depth limits, attackers can craft malicious payloads that exploit this flaw, causing node crashes and denial of service.

• Code Location: Vulnerability resides in the packet decoding mechanism:

  err := codec.UnmarshalJSON(data, &someStruct)
  if err != nil {
      return err
  }
  

  Excessive nesting in payloads causes stack overflow due to unbounded recursion.

Vulnerability 2: ASA-2024-0013 (Resource Exhaustion)

• Description: Nested messages in transactions processed by ZetaChain’s Cosmos SDK dependency can cause exponential CPU and memory usage. Malicious actors could exploit this by submitting deeply nested transactions, overwhelming the system.

• Code Location: Unpacking interfaces without validation creates resource exhaustion risks:

  err := someStruct.UnpackInterfaces(unpacker)
  if err != nil {
      return err
  }
  

---

Impact Explanation

Severity: Critical

ASA-2024-0012 (Stack Overflow):

• Impact: Exploitation can lead to complete node crashes and halt network consensus, disrupting ZetaChain’s ability to process internal and cross-chain transactions. This aligns with the impact scope:
  • "Network not being able to confirm new transactions (total network shutdown)."
  • "Unintended permanent chain split requiring hard fork."

ASA-2024-0013 (Resource Exhaustion):

• Impact: Malicious transactions could cause critical resource exhaustion, leading to widespread validator downtime and reduced decentralization. This aligns with the impact scope:
  • "Causing network processing nodes to process transactions from the mempool beyond set parameters."
  • "Shutdown of greater than or equal to 30% of network processing nodes without brute force actions."

---

Likelihood Explanation

Given the reliance of ZetaChain’s infrastructure on Cosmos SDK, this vulnerability is likely exploitable in its current implementation. The absence of depth and resource validation mechanisms increases the risk of exploitation.

---

Proof of Concept

https://dailycve.com/cosmos-sdk-transaction-decoding-vulnerabilities-asa-2024-0012-asa-2024-0013-high-severity/ https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-8wcc-m6j2-qxvm

ASA-2024-0012:

A crafted transaction payload with excessive nested data can be submitted via the following steps:

1. Generate a payload with deeply nested JSON data.
2. Submit the transaction to a node processing transactions.
3. Observe the crash due to stack overflow.

ASA-2024-0013:

1. Craft a transaction with recursive nested messages.
2. Submit the transaction repeatedly to overwhelm node resources.
3. Monitor resource exhaustion and node crashes.

---

Recommendation

• Mitigation: Upgrade to Cosmos SDK versions v0.47.15 or v0.50.11, which address these vulnerabilities by adding recursion depth limits and enhanced resource validation.
• Validation: Conduct rigorous testing to ensure deep nesting and excessive unpacking are handled gracefully.
• Monitoring: Implement monitoring tools to detect abnormal transaction patterns, CPU usage, and memory consumption.

---

Proof of Concept

https://dailycve.com/cosmos-sdk-transaction-decoding-vulnerabilities-asa-2024-0012-asa-2024-0013-high-severity/ https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-8wcc-m6j2-qxvm

ASA-2024-0012:

A crafted transaction payload with excessive nested data can be submitted via the following steps:

1. Generate a payload with deeply nested JSON data.
2. Submit the transaction to a node processing transactions.
3. Observe the crash due to stack overflow.

ASA-2024-0013:

1. Craft a transaction with recursive nested messages.
2. Submit the transaction repeatedly to overwhelm node resources.
3. Monitor resource exhaustion and node crashes.

---