SEDA Protocol · FINDING NOTE
An outdated dependency could halt the chain
Reported as HarryBarz. View the public report
The final report credits several researchers for identifying SEDA’s exposure to an existing Cosmos SDK advisory. The upstream issue was originally reported by dongsam.
1 min read
Page link
Summary
A dependency update was also an availability fix. SEDA’s version of the Cosmos SDK still contained a disclosed bug that could interrupt the chain’s transaction processing.
Root cause
SEDA depended on a release that still contained a fault in the groups module. An error during proposal processing could interrupt chain execution, making the dependency choice part of the network's availability risk.
Attack scenario
The reported threat involved hostile activity in the groups module interrupting chain execution. A failure in one module could therefore affect users who had no involvement in that activity.
Impact
A chain halt would interrupt transaction processing for users and affect validators and full nodes. The report describes an availability failure, with consequences extending beyond the particular proposal being handled.
Fix recommendation
Adopt the upstream patched dependency and include security advisories in release reviews. Sherlock identifies SEDA pull request 517 as the remediation; the linked change is merged.