Gate News message, April 22 — Security researcher Doyeon Park disclosed a critical CVSS 7.1 zero-day vulnerability in Cosmos’ consensus layer CometBFT that could cause nodes to freeze during block synchronization, potentially affecting networks securing over $8 billion in assets. The vulnerability cannot directly steal funds.
Park initiated a coordinated disclosure process on February 22 but encountered resistance from the vendor, who requested public GitHub issue submission while refusing public disclosure. On March 4, HackerOne marked his second report as spam. On March 6, the vendor arbitrarily downgraded a related vulnerability (CVE-2025-24371) to “informational” level, dismissing international standards. Park submitted a network-level proof-of-concept to counter this decision before publicly disclosing the flaw on April 21.
Park recommends that Cosmos validators avoid restarting nodes before a patch is released. Nodes already in consensus mode can continue operating, but restarting and entering synchronization may expose them to attacks from malicious peers, potentially causing deadlock.
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
Privacy Protocol Umbra Shuts Down Frontend to Block Attackers from Laundering Stolen Kelp Funds
Gate News message, April 22 — Privacy protocol Umbra has shut down its frontend website to prevent attackers from using the protocol to transfer stolen funds following recent attacks, including the Kelp protocol breach that resulted in losses exceeding $280 million. Approximately $800,000 in stolen
GateNews1h ago
Misty 23pds Alert: Lazarus Group releases a new macOS toolkit targeting cryptocurrencies
Misty’s Chief Information Security Officer 23pds issued an alert on April 22, stating that the North Korean hacking group Lazarus Group has released a new native macOS malware toolkit called “Mach-O Man,”专a专专专專專專 specialized in the cryptocurrency industry and high-value enterprise executives.
MarketWhisper3h ago
Justin Sun Sues World Liberty Financial Over Frozen WLFI Tokens and Governance Rights
Gate News message, April 22 — Justin Sun has filed a lawsuit in California federal court against World Liberty Financial (WLF), a DeFi project backed by Eric Trump and Donald Trump Jr., alleging that the team froze all his WLFI holdings, removed his voting rights, and threatened to permanently burn
GateNews4h ago
Venus Protocol 攻擊者轉移 2301 枚 ETH，流入 Tornado Cash 清洗
According to the on-chain analyst Ai Auntie’s monitoring on April 22, the Venus Protocol attacker transferred 2,301 ETH (about $5.32 million) to address 0xa21…23A7f 11 hours ago, then moved the funds in batches into the crypto mixer Tornado Cash for laundering; as of the time of monitoring, the attacker still held about $17.45 million worth of ETH on-chain.
MarketWhisper5h ago
CometBFT zero-day vulnerability exposed, $8.0 billion Cosmos network nodes face a risk of permanent lockup
Security researcher Doyeon Park disclosed on April 21 that there is a high-severity zero-day vulnerability rated CVSS 7.1 in the Cosmos consensus layer CometBFT. It could allow a malicious peer node to attack nodes during the block synchronization (BlockSync) stage and cause them to deadlock, impacting a network that safeguards more than $8 billion in assets.
MarketWhisper5h ago
