XRPL EVM: Preventive Response to Cosmos EVM incident

Coordinated response to the actively exploited cosmos/evm vulnerability of August 2026 (CVE class: EVM state-balance manipulation via staking precompile).

Incident date: 2026-08-23
Status: Resolved
Document: v1.0 · 2026-08-26
Author: Adrià Carrera - CTO, Peersyst Technology

1. Executive summary

On Sunday 23 August 2026, the XRPL EVM sidechain mainnet was halted as a precaution following an urgent advisory from the Cosmos Labs security team: a critical vulnerability in cosmos/evm (a dependency shared by all Cosmos-EVM chains) was being actively exploited in production against other networks, and all chains without the latest patches were strongly advised to halt immediately rather than wait for a multi-day coordinated upgrade.

Peersyst coordinated the validator set overnight; block production stopped within 30 minutes of the halt request, in the early hours of a Sunday morning. The same day we built, verified, and released the patched node v10.2.0, distributed it to validators, and restored block production after 14 hours 17 minutes.

Outcome. No value was lost. A dedicated forensic review found no trace of exploitation or value extraction on XRPL EVM. Independent analysis further established that the exploited attack path was never reachable on this chain: it requires the staking precompile and the x/vesting module, neither of which is enabled on the XRPL EVM sidechain.

The halt was therefore a defense-in-depth measure taken on the direct recommendation of the Cosmos security team while a second, still-embargoed vulnerability in the same dependency remained under private disclosure. It was a deliberate choice to over-protect the network rather than rely solely on our own (ultimately correct) exposure analysis.

2. Background

The XRPL EVM sidechain node (exrp) builds on cosmos/evm, maintained by Cosmos Labs. In August 2026 two distinct security issues affected this dependency:

Advisory A (private, 12 Aug). An embargoed vulnerability disclosed privately by Cosmos Labs, with patches distributed through a private repository and public disclosure originally scheduled for 21 Aug (later moved to 25 Aug). We executed the recommended interim mitigation immediately: an expedited governance proposal (#35) disabling permissionless ERC20 token-pair registration was submitted within 48 hours of the disclosure and passed on 15 Aug with unanimous validator support (16/16), closing the known exploit path on mainnet ahead of any patch. In parallel, a coordinated, non-emergency upgrade was planned with testnet-first rollout.

Advisory B (20–21 Aug). A separate vulnerability: an unchecked SubBalance in the EVM state database that lets a vesting account delegating locked coins through the staking precompile trigger a balance underflow, effectively minting unlimited native tokens. This one was exploited in production: one Cosmos-EVM chain was attacked and halted on 20–21 Aug, and a second chain was exploited on 22 Aug (≈2.99 B native tokens minted in a single transaction) before halting.

Fixes for Advisory B were published by Cosmos in cosmos/evm v0.6.2 / v0.7.2 on 21 Aug; combined private tags containing both advisories' fixes were published to the embargo repository the same day.

3. Why XRPL EVM was not exposed

Immediately upon the first Cosmos recommendation on 21 Aug, two days before the halt, we audited the live mainnet configuration against the vulnerability's preconditions, verifying each point empirically against chain state (height ~7,333,096) rather than assuming a stock deployment:

Staking precompile enabled

XRPL EVM Mainnet: Not enabled

Verification: Not in active_static_precompiles; direct calls to 0x…0800 return empty.

x/vesting module (locked-coin accounts)

XRPL EVM Mainnet: Not wired into the app

Verification: Zero vesting accounts exist on chain.

Bond denom mirrored by the EVM

XRPL EVM Mainnet: Not mirrored

Verification: Staking uses poa (permissioned set), EVM denom is axrp; staking-driven bank events are invisible to EVM balances.

Any one of these breaks the attack chain; XRPL EVM lacked all three. After the second chain was exploited, we additionally reconstructed that attack's forensics from its public RPC and confirmed the enabling conditions present there (active staking precompile answering calls, bond denom mirrored) are absent on XRPL EVM, validating our analysis against a real attack, not only against the advisory text.

Cosmos nonetheless cautioned that disabling the staking precompile was not considered a complete mitigation, and a second embargoed vulnerability in the same dependency was still private. Consistent with that guidance, we treated our non-exposure analysis as grounds for confidence, not as grounds for inaction, and followed the strongest recommended course: halt, patch, verify, resume.

4. Timeline

All dates August 2026; times US Eastern (EDT, UTC-4) unless noted. The team and validator set operate on European time (CEST, 6 hours ahead). Sources: Cosmos security emails, the shared security coordination channel, validator coordination records, and git/release history.

Advisory A: private disclosure (ERC20 registration)

Tue 12, 15:35: Cosmos Labs privately discloses a critical cosmos/evm vulnerability under embargo, with an interim mitigation: disable permissionless ERC20 token-pair registration via governance. We begin executing it immediately and schedule a coordinated upgrade with testnet-first rollout.

Thu 14, 13:09: Expedited governance proposal #35 submitted (17:09 UTC), setting permissionless_registration: false, within 48 hours of the private disclosure.

Fri 15, 13:09: Proposal #35 passes with unanimous support (16/16 voting validators, 100% yes). The known exploit path for Advisory A is closed on mainnet ahead of any patch.

Advisory B: active exploitation and emergency response

Thu 20, 21:28: A Cosmos-EVM chain reports active exploitation and halts; Cosmos security response begins in the shared coordination channel. Two hours later, the Cosmos security email details the root cause (staking-precompile / vesting balance underflow) and fix commits, requesting an upgrade to v0.6.2 / v0.7.2 as a coordinated (non-emergency) upgrade.

Fri 21, 05:33: General recommendation to all chains posted in the coordination channel. Within two minutes we engage Cosmos to pin down the exact scope and impact.

Fri 21, morning: Full exposure audit of live mainnet completed (see §3): the exploited path is not reachable on XRPL EVM. Per Cosmos guidance at this point, a coordinated upgrade, not an emergency halt, is the recommended course for all chains; ours is already scheduled.

Sat 22, 15:46: A second chain is exploited in production (19:46 UTC; ≈2.99 B native tokens minted in one transaction) and halts ~4 h later. We later reconstruct the attack independently from its public RPC to re-validate our own non-exposure.

Sat 22, 19:45: Escalated advisory: all chains not yet running the patches should halt immediately and upgrade in place rather than wait for a coordinated multi-day process.

Sun 23, ~00:30: On picking up the overnight advisory we trigger the emergency procedure and contact every validator. Enough validators (6 of 17, over one third of voting power) stop within ~30 minutes of the request, halting consensus before dawn in Europe.

Sun 23, 01:02: Last block 7,360,028 produced (05:02 UTC). Chain halted. No further state transitions possible; the theoretical attack window is closed.

Sun 23, 03:00–04:00: Release preparation: Cosmos v0.6.2 and the combined embargo hotfix tag merged into our release branch, verified by git ancestry and full tree diff to contain all published fixes plus the embargoed patch and our consensus-relevant fork customizations.

Sun 23, 05:08: Node release v10.2.0 published (09:08 UTC): the exact mainnet baseline (v10.1.0) plus the verified security module, a minimal and auditable delta.

Sun 23, daytime: Release testing; binary distributed to validators with upgrade instructions; parallel forensic sweep of chain history for any form of value extraction: none found.

Sun 23, 15:19: Chain resumes at block 7,360,029 (19:19 UTC) on patched binaries. Total halt: 14 h 17 m. Network healthy; no further incidents.

5. Coordination actions

Validator set

All validators were contacted directly upon the escalated advisory. Block production stopped within ~30 minutes of the halt request, in the small hours of a Sunday, and the full set was brought back online in a controlled sequence the same day on patched binaries. The response demonstrated a strong and highly dedicated validator set: every operator was reachable and acted within minutes, overnight on a weekend.

Cosmos security team

We engaged Cosmos Labs continuously from the first advisory, with scoping questions within minutes of each notice and independent verification of every patch. We want to thank and credit the Cosmos security team for their outstanding handling of the situation: clear and timely advisories, patches for every maintained release line, and around-the-clock availability throughout the weekend. Their ecosystem-wide coordination was instrumental in resolving the incident quickly and without losses.

6. Impact assessment

Funds: zero loss. A forensic review of chain history found no anomalous mints, no balance manipulation, and no value extraction of any form.

Exploitability: the actively exploited path was never reachable on XRPL EVM (§3). The halt eliminated even residual risk from unknown paths while the embargoed vulnerability remained private.

Availability: 14 h 17 m of paused block production and RPC staleness on a Sunday; the chain resumed from the exact halted height with full state integrity.

Reputation/community: no user escalations; partner and institutional communications were proactive and consistent throughout.