security(medium): IBC v2 (Eureka) entrypoints skip contract setup gas cost
Open
- Dominant language
- Go
- Stars
- 416
- Forks
- 538
- PR merge metrics
- No merged PRs in 30d
Description
[CWA-2025-005](https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2025-005.md) fixed this for IBC v1 paths, but not v2
Gas under-metering / DoS amplification
This impacts and wasmd version with IBC v2 support (so CosmosHub / Gaia)
Posting here since it's already a public CVE & and only effects CosmosHub
Contributor guide
Research direction
Read CWA-2025-005 first, then locate the IBC v2 (Eureka) entrypoints and compare them with the IBC v1 paths covered by that fix. Confirm that contract setup gas is accounted for on v2 paths and add regression coverage for the affected entrypoints.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, wasm
- Domain
- distributed-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 42/100