AIKIDO-2025-10152

github.com/Cosmos/ibc-go/v7 is vulnerable to Expected Behavior Violation

Expected Behavior ViolationGHSA-4wf3-5qj9-368v

Critical Risk

This Affects:

github.com/Cosmos/ibc-go/v7

7.0.0 - 7.9.2

Fixed in 7.10.0

Are you affected? Scan for Free

TL;DR

Affected versions of this package are vulnerable to non-deterministic JSON unmarshalling in IBC acknowledgements, which can cause a chain halt. This issue affects IBC-Go versions >= v7 and potentially earlier versions. Any user capable of opening an IBC channel can trigger this vulnerability, leading to network disruption. The latest patch extends protections to all applications beyond transfer.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

github.com/Cosmos/ibc-go/v7 is vulnerable to Expected Behavior Violation in versions 7.0.0 - 7.9.2.

How to fix this

Upgrade the github.com/Cosmos/ibc-go/v8 library to the patch version. To prevent this state from being introduced to a chain, it is possible to permission Channel Opening as a workaround.

Critical Risk