Impact

In Cronos nodes running versions before v0.7.0, the contract selfdestruct invocation permanently removes the corresponding bytecode from the internal database storage. However, due to a bug in Ethermint, all contracts that used the identical bytecode (i.e shared the same CodeHash) will also stop working once one contract invokes selfdestruct, even though the other contracts did not invoke the selfdestruct OPCODE.

Thanks to the successfully coordinated security vulnerability disclosure, no smart contracts were impacted through the use of this vulnerability.

Smart contract states and storage values are not affected by this vulnerability.

User funds and balances are safe.

Patches

This problem has been patched in Cronos v0.8.0. The patch has state machine-breaking changes and the required coordinated network upgrade was done on the block height 3982500 on the Cronos mainnet beta network.

Workarounds

If a contract is subject to DoS due to this issue, the user can redeploy the same contract, i.e with identical bytecode, so that the original contract's code is recovered.

Credits

Thanks to the

• Cronos Team: @yihuang and @tomtau for discovering the issue, @gakuzen-crypto, @polycryptics, @FinnZhangCrypto, @wilson-ang, @brianatcrypto for the impact analysis.
• Evmos Team: @facs95 for patching the issue and @fedekunze for managing the release and coordinating between teams.

For more information

Please see the full advisory on Ethermint for more details.
If you have any questions or comments about this advisory:

• Open a discussion in crypto-org-chain/cronos
• Email us at [email protected]