mediumLogic errorCosmos-SDK
Andromeda – Validator Staking ADO and Vesting ADO: Valid VFS paths with usernames can always fail validation
- Payout
- $0
- Protocol
- Andromeda – Validator Staking ADO and Vesting ADO
- Disclosed
- Jun 23, 2024
- Source
- sherlock
In AndromedaOS, VFS path validation via get_raw_address() resolves home and lib paths by calling api.addr_validate() on the username-or-address segment. When a registered username is itself a syntactically valid Bech32 address, the resolver treats it as a raw …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.