Attention Validators:
This morning, core Cosmos SDK developers released a security patch for the high-severity Cosmos Barberry issue. The Agoric team independently identified a medium severity issue in its fork of the cosmos-sdk, and the patch for this was distributed along with the Cosmos Barberry security patch release. Per the runbook, an advisory was sent to Agoric validators to give them ample notice to prepare for security coordination.
A “soft-patch” release for these issues is now available, and it can be applied as a soft-patch without having to go through a full consensus upgrade or on-chain governance. Within approximately 45 minutes of the release, Agoric validators exceeded the 33.3% patching threshold per the recommendation that validators should update their nodes as quickly as possible in order to protect mainnet from exploitation. A PismoD branch will be available soon, and the patches for both issues will be added to the next release candidate (rc3) for mainnet1b and Vaults to ensure the patches are included in any consensus upgrade to promote the release candidate to mainnet.
We anticipate that the full details of this issue will be published at a later time by core Cosmos developers, and the Agoric team will be publishing a retrospective of the issue surfaced in its fork of cosmos-sdk once all impacted parties we are in contact with have patched.
If you have questions about this incident, the patching instructions, or any emergency security coordination in the future, you can reach our team directly at security@agoric.com.
