Cosmos SDK and IBC vulnerabilities in disclosed bug bounty reports
App-chain security is consensus security: a module bug can halt a chain or mint supply without any contract being involved.
- Reports indexed
- 1
- Total paid
- $250k
- Critical
- 0
- Largest payout
- $250k
Cosmos chains ship their own state machine, so the vulnerable surface is module code rather than deployed contracts. Non-deterministic execution across validators, unbounded iteration in `BeginBlock`, and panics reachable from user messages all translate directly into liveness failures for the whole network.
IBC adds a cross-chain layer with its own failure modes: packet timeout handling, acknowledgement processing, and the escrow accounting that keeps voucher supply matched to locked supply. Several of the highest-value disclosures in this environment are IBC accounting bugs rather than exploits in the usual sense.
Where CosmWasm is in play, the contract-level classes from the EVM taxonomy reappear, with the addition of reply-handler and submessage ordering issues specific to the runtime.
What reviewers look for
- Non-deterministic behaviour across validator implementations
- Unbounded loops or unbounded state growth in block handlers
- Panics reachable from unauthenticated messages
- IBC escrow accounting divergence between chains
- CosmWasm reply handlers processing untrusted submessage results
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.