id: GO-ID-PENDING
modules:
    - module: github.com/evmos/evmos/v13
      unsupported_versions:
        - last_affected: 13.0.2
      vulnerable_at: 13.0.2
    - module: github.com/evmos/evmos/v13
      unsupported_versions:
        - last_affected: 13.0.2
      vulnerable_at: 13.0.2
      packages:
        - package: github.com/evmos/evmos/v13/x/vesting
summary: Evmos vulnerable to unauthorized account creation with vesting module in github.com/evmos/evmos
description: |-
    ### Impact _What kind of vulnerability is it? Who is impacted?_

    Using the vesting module, a malicious attacker can create a new vesting account
    at a given address, before a contract is created on that address.

    Addresses of smart contracts deployed to the EVM are deterministic. Therefore,
    it would be possible for an attacker to front-run a contract creation and create
    a vesting account at that address. When an address has been initialized without
    any contract code deployed to it, it will not be possible to upload any
    afterwards. In the described attack, this would mean that a malicious actor
    could prevent smart contracts from being deployed correctly.

    In order to remediate this, an alternative user flow is being implemented for
    the vesting module:
    - only the account receiving the vesting funds will be able to create such an
    account by calling the `CreateClawbackVestingAccount` method and defining a
    funder address
    - vesting and lockup periods can then be created by that funder address using
    `FundClawbackAccount`

    ### Patches _Has the problem been patched? What versions should users upgrade
    to?_

    ### Workarounds _Is there a way for users to fix or remediate the vulnerability
    without upgrading?_

    ### References _Are there any links users can visit to find out more?_
ghsas:
    - GHSA-m99c-q26r-m7m7
references:
    - advisory: https://github.com/evmos/evmos/security/advisories/GHSA-m99c-q26r-m7m7
notes:
    - lint: 'description: possible markdown formatting (found ### )'
    - lint: 'description: possible markdown formatting (found `CreateClawbackVestingAccount`)'
    - lint: 'modules[0] "github.com/evmos/evmos/v13": unsupported_versions: found 1 (want none)'
    - lint: 'modules[1] "github.com/evmos/evmos/v13": unsupported_versions: found 1 (want none)'
source:
    id: GHSA-m99c-q26r-m7m7
    created: 1999-01-01T00:00:00Z
review_status: REVIEWED