CVE-2021-25836

Name of the Vulnerable Software and Affected Versions Cosmos Network Ethermint versions <= 0.4.0

Description The issue concerns a cache lifecycle inconsistency in the EVM module. Specifically, when a transaction fails, the bytecode associated with it remains in memory, stored in stateObject.code, and is subsequently written to the persistent store during the Endblock stage. This behavior can potentially be exploited to create honeypot contracts.

Recommendations For Cosmos Network Ethermint versions <= 0.4.0, consider updating to a version that addresses the cache lifecycle inconsistency in the EVM module to prevent potential exploitation. As a temporary workaround, restrict the use of the EVM module until a patch is available.