How severe is GHSA-j496-crgh-34mx?

GHSA-j496-crgh-34mx has a CVSS score of 9.1/10, rated CRITICAL. Immediate patching is strongly recommended.

Which packages are affected by GHSA-j496-crgh-34mx?

GHSA-j496-crgh-34mx affects the following packages: github.com/cosmos/ibc-go/v4 (Go), github.com/cosmos/ibc-go/v5 (Go), github.com/cosmos/ibc-go/v6 (Go), github.com/cosmos/ibc-go/v7 (Go), github.com/cosmos/ibc-go/v8 (Go), github.com/cosmos/ibc-go/v3 (Go), github.com/cosmos/ibc-go/v2 (Go), github.com/cosmos/ibc-go (Go). Ecosystems affected: Go.

How do I fix GHSA-j496-crgh-34mx?

Update github.com/cosmos/ibc-go/v4 to 4.6.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-j496-crgh-34mx is resolved across your whole dependency graph.

How do I detect GHSA-j496-crgh-34mx in my Go dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/cosmos/ibc-go/v4. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

How do I mitigate GHSA-j496-crgh-34mx if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against GHSA-j496-crgh-34mx?

O3 pinpoints whether GHSA-j496-crgh-34mx is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Is GHSA-j496-crgh-34mx actively exploited in the wild?

No public exploit code has been indexed for GHSA-j496-crgh-34mx yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-j496-crgh-34mx published, and has it been updated?

GHSA-j496-crgh-34mx was published on April 5, 2024 and was last updated on May 20, 2024. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐹 Go

GHSA-j496-crgh-34mx

CRITICAL

ibc-go: Potential Reentrancy using Timeout Callbacks in ibc-hooks

Also known asGO-2024-2694

Published

Apr 5, 2024

Updated

May 20, 2024

Affected

8 pkgs

Patched

5 / 8

Exploits

None indexed

Blast Radius

8 pkgs affected

🐹github.com/cosmos/ibc-go/v4🐹github.com/cosmos/ibc-go/v5🐹github.com/cosmos/ibc-go/v6🐹github.com/cosmos/ibc-go/v7🐹github.com/cosmos/ibc-go/v8🐹github.com/cosmos/ibc-go/v3🐹github.com/cosmos/ibc-go/v2🐹github.com/cosmos/ibc-go

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Name: ASA-2024-007: Potential Reentrancy using Timeout Callbacks in ibc-hooks Component: ibc-go Criticality: Critical (ACMv1: I:Critical; L:AlmostCertain) Affected versions: < v4.6.0, < v5.4.0, < v6.3.0, < v7.4.0, < v8.2.0 Affected users: Chain Builders + Maintainers

Summary

Through the deployment and subsequent use of a malicious CosmWasm contract via IBC interactions, an attacker could potentially execute the same MsgTimeout inside the IBC hook for the OnTimeout callback before the packet commitment is deleted. On chains where ibc-hooks wraps ICS-20, this vulnerability may allow for the logic of the OnTimeout callback of the transfer application to be recursively executed, leading to a condition that may present the opportunity for the loss of funds from the escrow account or unexpected minting of tokens.

Affected Configurations

Chains which satisfy all of the following requirements are considered to be impacted by this vulnerability:

Chain is IBC-enabled and uses a vulnerable version of ibc-go
Chain is CosmWasm-enabled and allows code uploads for wasm contracts by anyone, or by authorized parties (to a lesser extent)
Chain utilizes the ibc-hooks middleware and wraps ICS-20 transfer application

Next Steps for Impacted Chain Builders and Maintainers

It is advised to immediately upgrade to the latest patch fix version of ibc-go for your chain. If you have already applied a soft-patch through private coordination, we recommend additionally updating to the latest ibc-go version via normal software upgrade governance.

If you have not upgraded your chain yet, and you desire to mitigate exposure to this vulnerability in the meantime, it is advisable to limit code uploading for contracts to trusted parties on your chain.

If your chain only allows permissioned, access-controlled contract uploads, it is still strongly recommended to update to the latest patched ibc-go version for your chain per your normal software upgrade process.

Preparing for future coordination

If your chain would like to be included in future coordination efforts, please ensure your chain has a prominently displayed or otherwise easily available up-to-date email address for technical security contact available. A security.md file in the root of your projects’ code repository should contain this information. Additionally, please test this security contact with an unaffiliated email to ensure it works as expected and can receive emails from outside of your domain.

To ensure that your chain is included in future impact assessments, please keep your chain information up to date in the Cosmos Chain Registry with code location, network name, and public RPC and API endpoints in the details.

We recommend that all chains configure and practice the use of the Circuit Breaker module in the Cosmos SDK, as future vulnerability notifications may require the use of this mechanism as a mitigation against exploitation.

Recognition

This issue was reported to the Cosmos Bug Bounty Program on HackerOne on 3/26/24 by Maxwell Dulin (Strikeout) at Asymmetric Research. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.

Notes

Due to the critical nature of this issue, both the ibc-go team and Amulet independently performed impact assessments for the ecosystem, which informed a risk-driven private patching effort that preceded this public release. This private patching effort significantly reduced the exposure of the ecosystem to this vulnerability. We appreciate the diligence and professionalism of all chains and validators involved with this effort – your ability to move quickly while maintaining confidentiality was instrumental in protecting the wider Interchain Ecosystem.

If you ever have questions about security coordination efforts, public or private, please reach out to our official communication channel at [email protected].

For more information about ibc-go, please see https://ibc.cosmos.network/main.

For more information about the Interchain Foundation’s engagement with Amulet, please see https://github.com/interchainio/security.

Affected Packages

8 total 5 fixed

Ecosystem	Package	Vulnerable range	Fix
🐹Go	`github.com/cosmos/ibc-go/v4`	all versions	4.6.0
🐹Go	`github.com/cosmos/ibc-go/v5`	all versions	5.4.0
🐹Go	`github.com/cosmos/ibc-go/v6`	all versions	6.3.0
🐹Go	`github.com/cosmos/ibc-go/v7`	all versions	7.4.0
🐹Go	`github.com/cosmos/ibc-go/v8`	all versions	8.2.0
🐹Go	`github.com/cosmos/ibc-go/v3`	all versions	No fix

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/cosmos/ibc-go/v4. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update github.com/cosmos/ibc-go/v4 to 4.6.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-j496-crgh-34mx is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-j496-crgh-34mx is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-j496-crgh-34mx. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

**Name**: ASA-2024-007: Potential Reentrancy using Timeout Callbacks in ibc-hooks **Component**: ibc-go **Criticality**: Critical ([ACMv1](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md): I:Critical; L:AlmostCertain) **Affected versions**: < v4.6.0, < v5.4.0, < v6.3.0, < v7.4.0, < v8.2.0 **Affected users**: Chain Builders + Maintainers # Summary Through the deployment and subsequent use of a malicious CosmWasm contract via IBC interactions, an attacker could potentially execute the same `MsgTimeout` inside the IBC hook for the `OnTimeout` callback befor

O3 Security · Impact-Aware SCA

Is GHSA-j496-crgh-34mx in your dependencies?

O3 detects GHSA-j496-crgh-34mx across Go dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works