A $150,000 Discovery: How One Researcher Uncovered a Critical Bug in Evmos

In the world of Web3, security vulnerabilities can have devastating consequences. Recently, a pseudonymous researcher known as “jayjonah.eth” earned a remarkable $150,000 bounty for identifying a critical bug in the Evmos blockchain, a major player in the Cosmos Network ecosystem.

The Discovery

As part of the Evmos Bug Bounty Program, which has been operational since November 2022, jayjonah.eth dove into the Cosmos Network documentation. He discovered the concept of “module accounts,” which posed a significant risk to the blockchain’s stability. The documentation warned that if these addresses received funds outside expected parameters, it could break invariants, ultimately leading to a halted network.

In a blog post published on October 28, the researcher detailed his testing process. By sending funds to the module account in a controlled environment, he confirmed the risk:

“At this point, no more blocks are being produced, and the chain has completely halted. This breaks the Evmos blockchain and all the DApps built on it.”

After reporting the vulnerability, the Evmos team acted quickly to resolve the issue before it became public knowledge. For his critical finding, jayjonah.eth was awarded the highest tier payout, underscoring the importance of proactive security measures in blockchain technology.

In his closing remarks, jayjonah.eth encouraged other security researchers to thoroughly explore project documentation, emphasizing that “sometimes the most critical bugs can be extremely simple.” This approach not only aids in preventing cyberattacks but also minimizes potential losses if vulnerabilities are exploited.

The Shezmu Protocol: Negotiating with Hackers

The importance of bug bounty programs is further illustrated by another recent incident involving the Shezmu protocol. In September, the protocol negotiated with a hacker to recover nearly $5 million in stolen cryptocurrency. Initially, Shezmu offered a 10% bounty for the return of the funds but faced a counter-demand from the hacker for 20%. Ultimately, they reached an agreement, and Shezmu successfully recovered the majority of the stolen assets.

These incidents highlight the crucial role that bug bounty programs play in the blockchain ecosystem. By incentivizing researchers to identify and report vulnerabilities, projects can enhance their security posture and protect against potential attacks. As the Web3 landscape continues to evolve, collaboration between developers and security experts will be vital in fostering a safer environment for all users.