Bounty

Evmos

Cosmos

Shezmu

A Web3 security researcher earned a bounty reward of $150,000 by reading Cosmos Network documentation and finding a critical bug that could halt the Evmos blockchain and all decentralized applications (DApps) built on it.
Pseudonymous Spearbit security researcher “jayjonah.eth” received $150,000 for identifying a vulnerability in the Evmos blockchain as part of the Evmos Bug Bounty Program, which has been active since November 2022. 
In a blog post <a data-ct-non-breakable="null" href="https://medium.com/@jjordanjjordan/150-000-evmos-vulnerability-through-reading-documentation-d26328590a7a" rel="null" target="null" text="null" title="null">published</a> on Oct. 28, he explained coming across the concept of “module accounts” in the Cosmos documentation, which read:
<blockquote>
 “If these addresses (module accounts) receive funds outside the expected rules of the state machine, invariants are likely to be broken and could result in a halted network.”
</blockquote>
<h2 id="crash-testing-evmos-blockchain-based-on-cosmos-documentation">Crash-testing Evmos blockchain based on Cosmos documentation</h2>
The security researcher tried sending funds to the module account in a test environment to test the theory and reported:
<blockquote>
 “At this point, no more blocks are being produced and the chain has completely halted. This breaks the Evmos blockchain and all the DApps built on it.”
</blockquote>
He said that the Evmos team fixed the bug before the information was made public.
<figure>
 <img alt="Security, Cosmos, Web3" src="https://s3.cointelegraph.com/uploads/2024-10/0192d7ca-1378-7566-9631-8a36a71a31c4" title="">
 <figcaption style="text-align: center;">
 Evmos bug bounty payout system. Source: Evmos
 </figcaption>
</figure>
The researcher was awarded the highest tier payout for identifying a critical bug. On an end note, jayjonah.eth urged security researchers to read through project documents, adding that “sometimes the most critical bugs can be extremely simple.”
<figure>
 <img alt="Security, Cosmos, Web3" src="https://s3.cointelegraph.com/uploads/2024-10/0192d7cb-1b73-773c-9dbe-74b5f1c989ab" title="">
 <figcaption style="text-align: center;">
 Source: <a data-ct-non-breakable="null" href="https://x.com/jayjonah_eth/status/1850958520344027273" rel="null" target="null" text="null" title="https://x.com/jayjonah_eth/status/1850958520344027273">jayjonah_eth</a>
 </figcaption>
</figure>
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/tapioca-offer-bounty-to-4-million-phishing-attacker" rel="null" target="null" text="null" title="null">Tapioca offers $1M to ‘social engineering’ attacker who stole $4.7M</a>
In addition to helping projects alleviate the risk of cyberattacks, bug bounty programs are used as a tool to minimize losses in the event of a hack.
<h2 id="hacker-negotiates-bug-bounty-with-shezmu-protocol">Hacker negotiates bug bounty with Shezmu protocol</h2>
In September, leveraging yield protocol, <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/shezmu-recovers-5-million-stolen-funds-hacker-negotiation" rel="null" target="null" text="null" title="null">Shezmu recovered nearly $5 million in stolen crypto</a> through negotiations with a hacker after agreeing to a higher bounty demand.
Shezmu had initially offered the hacker a 10% bounty reward via an onchain message and requested the return of 90% of the stolen funds within 24 hours.
<figure>
 <img alt="Security, Cosmos, Web3" src="https://s3.cointelegraph.com/uploads/2024-10/0192d7cb-ad03-7f17-9a7a-022d8ec2461c" title="">
 <figcaption style="text-align: center;">
 Source: <a data-ct-non-breakable="null" href="https://x.com/ShezmuTech/status/1837257349125525786" rel="null" target="null" text="null" title="https://x.com/ShezmuTech/status/1837257349125525786">Shezmu</a>
 </figcaption>
</figure>
The hacker demanded 20% of the stolen funds as a bounty reward, which the protocol agreed to and received the remaining stolen funds.
Magazine: <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/hyped-up-depin-projects-barely-even-use-blockchain-true-or-false/" rel="null" target="null" text="null" title="null">Most DePIN projects barely even use blockchain: True or false?</a>

Evmos pays $150K bounty for critical bug found in Cosmos documentation

Table of Contents

Cointelegraph

Other articles published on Oct 29, 2024

Bitcoin Makes 75% Yearly Gain To Reach the $73000 Mark Days Before US Election

Why Qubetics Is the DeFi Opportunity You’ve Been Waiting For - How Solana and RCO Finance Drive S...

Faucets You Can’t Ignore: Exploring 2024’s Most Profitable Crypto Platforms

Bhutan’s Bold Bitcoin Move, 929 BTC Sold as Nation Climbs Global Crypto Ranks

Why Vantard’s ICO Is the Key To Unlocking the Memecoin Supercycle

The Smart Investor’s Guide: 5 Undervalued Cryptos with 10x Potential Next Month

Join our free newsletter for daily crypto updates!