Cosmowarp Contract
Monthly
Authorization bypass in the Rattadan Cosmowarp asset_registry smart contract (CosmWasm/Rust) lets any sender execute the privileged UpdateConfig message on deployments where the on-chain config.admin field is unset (None), because the sender-vs-admin check is nested inside an `if let Some(current_admin) = config.admin` block that is silently skipped. Impact is high on integrity and availability (VI:H/VA:H) with limited confidentiality loss (VC:L), scoring 8.4 under CVSS 4.0 and assessed as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H; exploitation is only possible against pre-56c6147 builds of the rattadan/Cosmowarp_Contract asset_registry module running with an unset admin, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. The condition is narrow but the consequence is full admin-level config control for whoever submits the transaction first.
Authorization bypass in the Rattadan Cosmowarp asset_registry smart contract (CosmWasm/Rust) lets any sender execute the privileged UpdateConfig message on deployments where the on-chain config.admin field is unset (None), because the sender-vs-admin check is nested inside an `if let Some(current_admin) = config.admin` block that is silently skipped. Impact is high on integrity and availability (VI:H/VA:H) with limited confidentiality loss (VC:L), scoring 8.4 under CVSS 4.0 and assessed as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H; exploitation is only possible against pre-56c6147 builds of the rattadan/Cosmowarp_Contract asset_registry module running with an unset admin, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. The condition is narrow but the consequence is full admin-level config control for whoever submits the transaction first.