Cosmos Labs Routed Public Silent Patch for Critical EVM Balance Flaw Despite April Bug Bounty Report and Known Fund Risk
Cosmos Labs knew of a critical EVM balance flaw by mid-August yet applied its public silent patch process, enabling drains across six chains. The post-mortem reveals internal misclassification and policy deviation on a fund-loss vulnerability. This exposes systemic coordination failures in shared Cosmos modules where public commits precede private fixes.
The root cause sits in vesting account delegation handling where EVM spendable balance subtracts the full delegated amount without bounds checks, producing a 2^256 delta that mints or burns on reconciliation. Chains on 0.6.x halt on supply overflow; 0.7.x accept direct balance sets after int conversion. The precondition requires only permissionless vesting account creation plus the staking precompile. Cosmos Labs received the report April 25 via bug bounty, misclassified it as non-18-decimal only, then shipped the fix publicly on August 19 under its silent patch track reserved for non-fund-loss issues.
Cosmos Labs: Three or more additional EVM chains will execute emergency halts within 14 days due to failed upgrade coordination.
Sources (3)
- [1]Cosmos Labs Post-Mortem August 28 2026(https://blog.cosmos.network/postmortem-ghsa-7g4w-cg88-2cq2)
- [2]Cosmos Bug Bounty Policy July 27 2026(https://github.com/cosmos/cosmos-sdk/security/policy)
- [3]Chain Incident Reports August 2026(https://forum.cosmos.network/t/evm-balance-exploit-august-2026)