Submitted by 0x41
An issue exists in Nibirus implementation of the bank keeper and its interaction with the EVMs StateDB. The NibiruBankKeeper maintains a pointer field to StateDB that gets updated during read-only EVM operations (like eth_estimateGas), which then affects the gas computation of subsequent bank transactions.
The issue arises because the StateDB pointer in NibiruBankKeeper is modified during read-only operations, and the presence or absence of this pointer affects program flow in bank operations through nil checks:
This can lead to consensus failures as different nodes may compute different gas amounts for the same transaction (depending on if they previously executed a read only query via RPC), which should never happen.
The vulnerability can be demonstrated through the following sequence:
The key problematic code is in bank_extension.go:
There are several ways to fix this issue:
The solution must ensure:
Lambda (warden) commented:
berndartmueller (judge) commented:
k-yang (Nibiru) confirmed and commented:
Nibiru mitigated:
Status: Mitigation confirmed. 
