bug-bounty498
google355
xss301
microsoft298
facebook263
rce211
exploit200
malware171
apple164
cve136
account-takeover115
bragging-post102
privilege-escalation95
csrf90
phishing86
browser75
writeup74
authentication-bypass69
supply-chain68
dos66
stored-xss65
reflected-xss57
ssrf56
reverse-engineering55
react52
access-control51
input-validation49
cross-site-scripting48
aws47
cloudflare47
docker46
web-security46
lfi46
sql-injection45
smart-contract45
ethereum44
web-application44
web343
defi43
ctf43
oauth43
node43
pentest40
race-condition39
idor37
open-source37
cloud37
burp-suite36
info-disclosure36
auth-bypass35
0
7/10
vulnerability
A vulnerability in Cronos/Ethermint allowed attackers to construct MsgEthereumTx messages without ExtensionOptionsEthereumTx, bypassing the EthGasConsumeDecorator handler and enabling theft of transaction fees from the current block through false gas refunds. The bug was fixed in v0.6.5 by adding validation to ensure MsgEthereumTx is properly wrapped.
gas-handling
fee-theft
cosmos-sdk
ethermint
ethereum-compatibility
antehandler
signature-verification
blockchain
bug-bounty
state-transition
Cronos
Ethermint
zb3
Immunefi
Cosmos SDK
Tendermint
MsgEthereumTx
ExtensionOptionsEthereumTx
EthGasConsumeDecorator
GHSA-f854-hpxv-cw9r