Zero-day vulnerabilities are critical discoveries that can leave websites, applications, and protocols exposed to takeover. Recently, there were attacks on Drift and Kelp DAO, and now all eyes are on the Cosmos blockchain ecosystem due to a newly disclosed threat.
Major flaw identified in Cosmos (ATOM)
The vulnerability was revealed by security researcher p6rkdoye0n and could cause node freezes during block synchronization on the Cosmos network, which secures over $8 billion in assets. Although the issue has a CVSS severity rating of 7.1 (High), it does not directly endanger digital assets in the way the Drift or Kelp DAO exploits did. The flaw primarily disrupts the functioning of the system rather than compromising funds.
The cybersecurity specialist who discovered the issue stated that he decided to go public after his concerns were not taken seriously by relevant parties.
“I made every effort to follow the Coordinated Vulnerability Disclosure (CVD) procedure for the safety of the ecosystem. However, because of a lack of cooperation and irresponsible decisions by the providers, I decided to disclose the vulnerability.
This action is being taken according to the provider’s final decision. All resulting security risks are entirely the responsibility of the provider. For this reason, I am sharing details about both their irresponsible approach and the specifics of the vulnerability here.
Until a patch is released, validator operators in the Cosmos ecosystem are strongly advised to avoid restarting their nodes if possible. The vulnerability is triggered during the block synchronization phase.
Nodes currently in consensus mode can continue to operate normally. However, if they are restarted and begin block synchronization, exposure to a malicious peer could lock them out, making it impossible for the node to rejoin the network.”
Response from Cosmos and ongoing risks
The researcher also noted that a more severe vulnerability had been reported via HackerOne, but it too was dismissed by those responsible. This raises further questions about the responsiveness and diligence of the Cosmos ecosystem’s security processes.
The initial report of the bug was submitted on February 22, and the following day, the Cosmos team responded by claiming the attack was not feasible. A second report was filed on March 4, but this time it was marked as spam. For over a month, p6rkdoye0n has attempted to warn about various weaknesses, receiving scant attention. For the time being, the researcher has chosen not to publicly release the exploit code. Although the Cosmos (ATOM) price has dropped to $1.77, no rapid price collapse has occurred so far.
Potential impact on the blockchain ecosystem
The newly uncovered vulnerability stands out not because it allows direct theft, but due to its potential to disrupt the reliable operation of a blockchain protocol that safeguards billions of dollars. In complex ecosystems, even operational bugs can have cascading effects and shake the confidence of network participants.
Following high-profile incidents with Drift and Kelp DAO, the Cosmos community is now facing increased scrutiny. Industry experts emphasize that issues compromising liveness and consensus—even without a direct attack on assets—can have systemic ramifications.
Given the CVSS severity score and the nature of the bug, industry observers expect an urgent response from the Cosmos team. Meanwhile, community members are monitoring the situation closely, as operational issues can indirectly influence asset values and user trust.
This incident also highlights lingering challenges with coordinated vulnerability disclosure in the blockchain industry. Security researchers often voice concerns about a lack of action and transparency from project teams, potentially leaving critical issues unaddressed for extended periods.
Many in the blockchain sector are now urging for improved communication protocols and more responsive engagement from core development teams when serious vulnerabilities are raised. Trust in the long-term health of $ATOM and the broader Cosmos ecosystem may hinge on such measures.
As Cosmos moves to address the newly publicized threat, both developers and validators are advised to exercise caution, avoid unnecessary restarts, and await further updates or patches to ensure continued network stability.
