Bounty

Evmos

Cosmos

Shezmu

A Web3 security researcher earned a bounty reward of $150,000 by reading Cosmos Network documentation and finding a critical bug that could halt the Evmos blockchain and all decentralized applications (DApps) built on it.
Pseudonymous Spearbit security researcher “jayjonah.eth” received $150,000 for identifying a vulnerability in the Evmos blockchain as part of the Evmos Bug Bounty Program, which has been active since November 2022. 
In a blog post <a data-ct-non-breakable="null" href="https://medium.com/@jjordanjjordan/150-000-evmos-vulnerability-through-reading-documentation-d26328590a7a" rel="null" target="null" text="null" title="null">published</a> on Oct. 28, he explained coming across the concept of “module accounts” in the Cosmos documentation, which read:
<blockquote>
 “If these addresses (module accounts) receive funds outside the expected rules of the state machine, invariants are likely to be broken and could result in a halted network.”
</blockquote>
<h2 id="crash-testing-evmos-blockchain-based-on-cosmos-documentation">Crash-testing Evmos blockchain based on Cosmos documentation</h2>
The security researcher tried sending funds to the module account in a test environment to test the theory and reported:
<blockquote>
 “At this point, no more blocks are being produced and the chain has completely halted. This breaks the Evmos blockchain and all the DApps built on it.”
</blockquote>
He said that the Evmos team fixed the bug before the information was made public.
<figure>
 <img alt="Security, Cosmos, Web3" src="https://s3.cointelegraph.com/uploads/2024-10/0192d7ca-1378-7566-9631-8a36a71a31c4" title="">
 <figcaption style="text-align: center;">
 Evmos bug bounty payout system. Source: Evmos
 </figcaption>
</figure>
The researcher was awarded the highest tier payout for identifying a critical bug. On an end note, jayjonah.eth urged security researchers to read through project documents, adding that “sometimes the most critical bugs can be extremely simple.”
<figure>
 <img alt="Security, Cosmos, Web3" src="https://s3.cointelegraph.com/uploads/2024-10/0192d7cb-1b73-773c-9dbe-74b5f1c989ab" title="">
 <figcaption style="text-align: center;">
 Source: <a data-ct-non-breakable="null" href="https://x.com/jayjonah_eth/status/1850958520344027273" rel="null" target="null" text="null" title="https://x.com/jayjonah_eth/status/1850958520344027273">jayjonah_eth</a>
 </figcaption>
</figure>
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/tapioca-offer-bounty-to-4-million-phishing-attacker" rel="null" target="null" text="null" title="null">Tapioca offers $1M to ‘social engineering’ attacker who stole $4.7M</a>
In addition to helping projects alleviate the risk of cyberattacks, bug bounty programs are used as a tool to minimize losses in the event of a hack.
<h2 id="hacker-negotiates-bug-bounty-with-shezmu-protocol">Hacker negotiates bug bounty with Shezmu protocol</h2>
In September, leveraging yield protocol, <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/shezmu-recovers-5-million-stolen-funds-hacker-negotiation" rel="null" target="null" text="null" title="null">Shezmu recovered nearly $5 million in stolen crypto</a> through negotiations with a hacker after agreeing to a higher bounty demand.
Shezmu had initially offered the hacker a 10% bounty reward via an onchain message and requested the return of 90% of the stolen funds within 24 hours.
<figure>
 <img alt="Security, Cosmos, Web3" src="https://s3.cointelegraph.com/uploads/2024-10/0192d7cb-ad03-7f17-9a7a-022d8ec2461c" title="">
 <figcaption style="text-align: center;">
 Source: <a data-ct-non-breakable="null" href="https://x.com/ShezmuTech/status/1837257349125525786" rel="null" target="null" text="null" title="https://x.com/ShezmuTech/status/1837257349125525786">Shezmu</a>
 </figcaption>
</figure>
The hacker demanded 20% of the stolen funds as a bounty reward, which the protocol agreed to and received the remaining stolen funds.
Magazine: <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/hyped-up-depin-projects-barely-even-use-blockchain-true-or-false/" rel="null" target="null" text="null" title="null">Most DePIN projects barely even use blockchain: True or false?</a>

Evmos pays $150K bounty for critical bug found in Cosmos documentation

Table of Contents

Cointelegraph

Other articles published on Oct 29, 2024

AEON MINING is the world’s safest cloud mining platform. Analysts believe that it can earn up to ...

Post-U.S. Election Predictions: Can Memecoins Surpass Bitcoin, AMBCrypto Reveals in October Report

Faucets You Can’t Ignore: Exploring 2024’s Most Profitable Crypto Platforms

SKALE Labs and Deadfellaz Partner to Launch Genre Defying Digital TCG ‘Death Touch’

DYDX lays off 35% of its core team

Intel moves toward modular GPUs with a new patent for chiplet-based architecture

Join our free newsletter for daily crypto updates!