Request Feedback in Security.

[Hellobloc]

Sorry to bother you, i just wonder could you give me some feedback in the security adverisory in github. thanks a lot!

[Hellobloc]

@xianxianzhou @YangChuantongStarry

[Hellobloc]

https://github.com/UptickNetwork/uptick/security/advisories/GHSA-fg36-f3xh-mwm9

[YangChuantongStarry]

Hi Hellobloc,

Thank you for reaching out regarding the security advisory GHSA-fg36-f3xh-mwm9. I appreciate you bringing this to our attention.

To move forward effectively, I've taken an initial step by creating a dedicated branch for investigating and addressing this issue:
Branch URL: https://github.com/UptickNetwork/uptick-ghsa-fg36-f3xh-mwm9.git

To ensure my feedback and any potential fixes are accurate and helpful, could you please clarify a few details?

1、Specific Feedback Request: Are you looking for feedback on the technical accuracy of the vulnerability description, the proposed patch, or the severity/impact assessment?

2、Context & Expectations: Have you already attempted any fixes or investigations on your side? If so, sharing any findings would be great.

[Hellobloc]

For Q1
We would like to receive feedback on your remediation plan, specifically whether the fix has been completed and could you release the security adversory after fix this.
For Q2
We have observed that some projects have already adopted fixes, some of which are based on our report, for example:
AltheaFoundation/althea-L1@ced08fc

Additionally, some projects had already implemented certain fixes before we identified this issue, for example:
https://github.com/zeta-chain/node/blob/main/app/ante/authz.go#L50-L93

hope this could help you! for wasm -> evm issue, there is two way to fix this, firstly use cosmos/evm instead of evmos and use CircuitBreaker to ban the evm message in DispatchMsg in Wasm!

https://github.com/MANTRA-Chain/mantrachain/blob/main/app/wasm.go#L9

@YangChuantongStarry

[Hellobloc]

https://github.com/NibiruChain/nibiru/blob/main/app/wasmext/wasm.go

This is other approach to fix this issue come from nibiru fix. You can see that they modified the implementation of wasmd's dispatchmsg to filter some messages in advance.

[Hellobloc]

https://hackmd.io/TGBPG3-vTeahHO4sIlJAjA?view here is the report for injective. hope this could help you! there is more detail for poc!

[YangChuantongStarry]

Thank you for your help