Bounty

Ethereum

Evmos

Cosmos

A Web3 security researcher received $150,000 from the Cosmos Network for identifying a critical bug that could halt the Evmos blockchain and all its decentralized applications.
On Oct. 29, a <a rel="noopener noreferrer nofollow" href="https://crypto.news/tag/web3/">Web3</a> security researcher from Spearbit with the username jayjonah.eth made an <a rel="noopener noreferrer nofollow" href="https://x.com/jayjonah_eth/status/1850958520344027273" target="_blank">X post</a> containing a blogpost he wrote about finding a bug in the Evmos(<a rel="noopener noreferrer nofollow" href="https://crypto.news/price/evmos/">EVMOS</a>) blockchain that could have proved catastrophic to its operations.
His efforts were rewarded by the <a rel="noopener noreferrer nofollow" href="https://crypto.news/tag/cosmos/">Cosmos Network</a> with a $150,000 payout for identifying the vulnerability. He discovered the bug while participating in the Evmos Bug Bounty Program on the bug bounty platform Immunefi, which has been active since November 2022.
A crypto bug bounty offers incentives to developers and researchers to help identify bugs and vulnerabilities within a system.
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
 <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 Discovered a $150,000 <a href="https://twitter.com/EvmosOrg?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">@EvmosOrg</a> vulnerability on <a href="https://twitter.com/immunefi?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">@immunefi</a> just by reading the docs! 📜🔍 Check out my latest write-up to see how paying attention to the basics led to a critical bug. 👇 <a href="https://twitter.com/SpearbitDAO?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">@SpearbitDAO</a> <a rel="noopener noreferrer nofollow" href="https://t.co/6WLJrgAtJz" target="_blank">https://t.co/6WLJrgAtJz</a>— jayjonah.eth (@jayjonah_eth) <a href="https://twitter.com/jayjonah_eth/status/1850958520344027273?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">October 28, 2024</a>
 </blockquote>
 <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
In his <a href="https://medium.com/@jjordanjjordan/150-000-evmos-vulnerability-through-reading-documentation-d26328590a7a" target="_blank" rel="noopener noreferrer nofollow">blog post</a>, the researcher explained that he came across the concept of “module accounts” while reviewing the Cosmos documentation, describing this review as “the first step” in identifying potential problems, as the documentation provides “the foundation” for understanding a blockchain.
He found a section within the document which read as follows:
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
 “Typically, these addresses are module accounts. If these addresses receive funds outside the expected rules of the state machine, invariants are likely to be broken and could result in a halted network,” wrote Evmos.
</blockquote>
You might also like: <a rel="noopener noreferrer nofollow" href="https://crypto.news/jump-crypto-offers-solana-devs-up-to-1m-in-firedancer-bug-bounty-program/"> Jump Crypto offers Solana devs up to $1m in Firedancer bug bounty program </a>
According to jayjonah.eth, this clause indicated that if users sent funds to module accounts, it could cause the blockchain to break. He then tested this by sending funds to the module accounts.
“At this point, no more blocks are being produced and the chain has completely halted. This breaks the Evmos blockchain and all the DApps built on it,” he wrote.
He reported his findings to the Evmos team, receiving $150,000, the highest prize awarded for a “critical” level bug. The researcher emphasized that the bug was a “low-hanging fruit” — simple yet easy to overlook.
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
 “This bug taught me a few important things as a security researcher. The first, and most obvious, is to always thoroughly read the documentation of the project you’re investigating,”
 -jayjonah.eth.
</blockquote>
Other projects have also been known to launch bug bounties to help detect hidden threats in their systems. Last August, Layer3, a decentralized attention layer project, <a rel="noopener noreferrer nofollow" href="https://crypto.news/layer3-launches-500k-bounty-program-to-strengthen-security/">launched</a> a bug bounty program in partnership with HackenProof. The bug bounty offers a reward of up to $500,000.
In July, Immunefi <a rel="noopener noreferrer nofollow" href="https://crypto.news/immunefi-and-ethereum-foundation-launch-attackathon-to-enhance-security-for-ethereum/">collaborated</a> with the Ethereum Foundation to launch “Attackathon,” an audit contest designed to challenge and enhance the Ethereum network’s security.
Read more: <a rel="noopener noreferrer nofollow" href="https://crypto.news/immunefi-and-ethereum-foundation-launch-attackathon-to-enhance-security-for-ethereum/"> Immunefi and Ethereum Foundation launch “Attackathon” to enhance security for Ethereum </a>

Web3 researcher awarded $150k for finding critical bug in Evmos blockchain

crypto.news

Other articles published on Oct 29, 2024

Shift4 to Offer Crypto Payments

Top Crypto Gainers Today Oct 29 – AIOZ Network, Pendle, Oasis Network, Axelar

Shuffle Casino: The fastest-growing casino with a 200% deposit bonus!

Blockchain untuk Jakarta? Simak Program "Adab" Dharma Pongrekun

Moniepoint raises $110m series C funding to power Africa expansion and FX business

Hacker Exploits Truth Terminal’s Influence for $600K in Scam Token Sale

Join our free newsletter for daily crypto updates!