The x/crisis package does not charge ConstantFee in github.com/cosmos/cosmos-sdk

GHSA-w5w5-2882-47pc · GO-2023-1881 · Published 06/07/2023 · updated 20/05/2024

In short

GO-2023-1881 is a not yet rated vulnerability affecting github.com/cosmos/cosmos-sdk.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
github.com/cosmos/cosmos-sdk Go	`all versions`	No fix yet

If a transaction is sent to the x/crisis module to check an invariant, the ConstantFee parameter of the chain is not charged.

No patch will be released, as the package is planned to be deprecated and replaced.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.