Cosmos SDK and IBC vulnerabilities in disclosed bug bounty reports

App-chain security is consensus security: a module bug can halt a chain or mint supply without any contract being involved.

Reports indexed
1
Total paid
$250k
Critical
0
Largest payout
$250k

Cosmos chains ship their own state machine, so the vulnerable surface is module code rather than deployed contracts. Non-deterministic execution across validators, unbounded iteration in `BeginBlock`, and panics reachable from user messages all translate directly into liveness failures for the whole network.

IBC adds a cross-chain layer with its own failure modes: packet timeout handling, acknowledgement processing, and the escrow accounting that keeps voucher supply matched to locked supply. Several of the highest-value disclosures in this environment are IBC accounting bugs rather than exploits in the usual sense.

Where CosmWasm is in play, the contract-level classes from the EVM taxonomy reappear, with the addition of reply-handler and submessage ordering issues specific to the runtime.

What reviewers look for

  • Non-deterministic behaviour across validator implementations
  • Unbounded loops or unbounded state growth in block handlers
  • Panics reachable from unauthenticated messages
  • IBC escrow accounting divergence between chains
  • CosmWasm reply handlers processing untrusted submessage results

Curated highlights

The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.

Vulnerability classes seen on this chain

Related chain / vm pages