GitHub Security Advisory: GHSA-54gx-3cgr-7mfm
Package: github.com/cosmos/evm (GO)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-670: Always-Incorrect Control Flow Implementation
Vulnerable versions: < 0.6.0
Patched in: 0.6.0

Summary: Cosmos EVM: incorrect state handling during nested EVM execution paths

Details:
**Advisory ID:** ASA-2026-002

**Component:** ICS20 Precompile

**Status:** Resolved

**Published:** March 2026

**Contact:** [security@cosmoslabs.io](mailto:security@cosmoslabs.io)

---

# Security Advisory ASA-2026-002

**Status: Resolved. A patch is available and all known affected chains have either applied mitigations or [upgraded](https://github.com/cosmos/evm/releases/tag/v0.6.0).**

| Field | Value |
| --- | --- |
| **Severity** | Critical |
| **Affected Component** | ICS20 Precompile |
| **Affected Versions** | Cosmos EVM implementations including the ICS20 precompile |
| **Patched Version** | [v0.6.0](https://github.com/cosmos/evm/releases/tag/v0.6.0) |
| **First Reported** | January 21, 2026 |
| **Public Disclosure** | March 2026 |

---

## Introduction

Recently, there was a vulnerability affecting a feature used by some chains built on the Cosmos EVM stack.  Working together with ecosystem partners and affected teams, particularly Saga, B-Harvest, Mantra, Zellic and Sherlock, Cosmos Labs  investigated the issue, coordinated mitigations, developed a permanent fix, and issued a patch to affected chains.

We appreciate the collaboration of the teams who assisted during the investigation and response process and thank our ecosystem partners for their support in coordinating mitigation and validation efforts.

---

## Remediation Summary

On January 21, 2026, Cosmos Labs was notified of suspicious activity on a network running the affected implementation. The issue resulted in financial loss on the Saga EVM network.

After confirming the vulnerability, Cosmos Labs coordinated with the affected chain team and ecosystem partners to investigate the issue, deploy mitigations, and assist other chains running the affected code.

Cosmos Labs contacted chains known to be running versions containing the affected component to verify their configurations and support mitigation where necessary. At the time of publication, all known affected chains have either applied mitigations or upgraded to a patched version.

---

## Root Cause

The vulnerability was caused by incorrect state handling during nested EVM execution paths involving the ICS20 precompile.

Under certain execution conditions, state updates performed during recursive calls were not correctly reflected in the outer execution context. This could allow repeated use of the same token balance within a single transaction.

---

## Mitigation

As an immediate mitigation, chains were advised to disable the ICS20 precompile through a coordinated upgrade.

Cosmos Labs assisted ecosystem teams in verifying whether their chains were affected and in applying the mitigation where required.

- 15 chains were identified as running code containing the issue
- 6 chains did not have the affected feature enabled
- The remaining chains implemented the mitigation before exploitation occurred
- 1 chain experienced an exploit prior to mitigation

---

## Long-Term Fix

A permanent fix was implemented to ensure