cheqd/cheqd-node · Security
cheqd-node affected by Non-deterministic JSON Unmarshalling of IBC Acknowledgement
- GHSA ID
- GHSA-33cr-m232-xqch
- Severity
- critical
- Published
- Updated
- CVSS v4
- 9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description
Description
An issue was discovered in IBC-Go's deserialization of acknowledgements that results in non-deterministic behavior which can halt a chain. Any user that can open an IBC channel can introduce this state to the chain.
This an upstream dependency used in cheqd-node, rather than a custom module.
Impact
Could result in a chain halt.
Patches
Validators, full nodes, and IBC relayers should upgrade to cheqd-node v3.1.7. This upgrade does not require a software upgrade proposal on-chain and is meant to be non state-breaking.
References
See ASA-2025-004: Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt upstream on IBC-Go.
CWEs
- CWE-502 · Deserialization of Untrusted Data
References
- https://github.com/cheqd/cheqd-node/security/advisories/GHSA-33cr-m232-xqch ↗
- https://github.com/cosmos/ibc-go/security/advisories/GHSA-jg6f-48ff-5xrw ↗
- https://github.com/cosmos/ibc-go/commit/59987d52d959dc5876ffd4f307c9b33a52a43748 ↗
- https://pkg.go.dev/vuln/GO-2025-3514 ↗
- https://github.com/advisories/GHSA-33cr-m232-xqch ↗