Verichains discloses blockchain security vulnerabilities that affected Cosmos, Binance Smart Chain, and others; Urges action

Verichains, a leading blockchain security firm, has urged projects using Tendermint’s IAVL proof verification to secure their assets and mitigate exploitation risks after identifying several significant vulnerabilities.

As part of its Responsible Vulnerability Disclosure, Verichains has released a public advisory, VSA-2022-100, on a critical Empty Merkle Tree vulnerability in the IAVL proof on Tendermint Core, a popular BFT consensus engine. Tendermint Core is the consensus engine that powers the Cosmos Hub and other Tendermint-based blockchains.

Verichains releases a second public advisory, VSA-2022-101 From Nil to Spoof – Critical IAVL Spoofing Attack via Multiple Vulnerabilities.

Verichains made this discovery while working last October in the wake of the BNB Chain bridge hack. Security specialists, who identified the critical IAVL Spoofing Attack via multiple vulnerabilities found in BNB Chain and Tendermint, say it could have resulted in a significant loss of funds.

BNB Chain was notified of these findings in October due to an existing working relationship and swiftly patched the issue.

A private disclosure was made to the Tendermint/Cosmos maintainer simultaneously, and they acknowledged the vulnerabilities. However, a patch was not released for the Tendermint library as the IBC and Cosmos-SDK implementation had already migrated to ICS-23 from IAVL Merkle proof verification. Currently, several projects are at risk, including Cosmos, Binance Smart Chain, OKX, and Kava.

Verichains has followed its Responsible Vulnerability Disclosure Policy to notify the public after 120 days. The critical nature of the bug may lead to further bridge hacks and consequent loss of funds, which in some cases could result in millions or even billions of dollars lost.

Verichains has urged affected Web3 projects which still use Tendermint’s IAVL proof verification to upgrade their security. The Verichains team regularly posts security flaws and vulnerabilities identified during research and testing on the company’s website.

Founded in 2017, Verichains is a leading blockchain security firm specializing in code audits, training, automated security analysis tool development, and reverse engineering software. The company leverages extensive security, cryptography, and core blockchain technology expertise. It has helped investigate and fix security issues in major global crypto hacks, including the BNB Bridge and Ronin Bridge. Verichains also has over 200 clients and $50 billion in assets under protection.