Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CWA-2024-009: Mention wasmvm 1.5.7 and add wasmd 0.34.1 #59

Merged
merged 4 commits into from
Jan 13, 2025
Merged

CWA-2024-009: Mention wasmvm 1.5.7 and add wasmd 0.34.1 #59

Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
3eb7b86
Mention wasmvm 1.5.7 and add wasmd 0.34.1
chipshort Jan 8, 2025
69c888d
Fix sentence
chipshort Jan 9, 2025
c5569b8
Fix diff commit
chipshort Jan 10, 2025
cf28943
Fix affected versions
chipshort Jan 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 10 additions & 6 deletions CWAs/CWA-2024-009.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,11 +6,13 @@ Low (Marginal + Likely)[^1]

**Affected versions:**

- wasmd < 0.53.1
- wasmd > 0.34.1, < 0.53.1
chipshort marked this conversation as resolved.
Show resolved Hide resolved
- wasmd < 0.34.1

**Patched versions:**

- wasmd 0.53.2 (please note that wasmd 0.53.1 is broken and must not be used)
- wasmd 0.34.1

## Description of the bug

Expand All @@ -23,8 +25,10 @@ These can then easily be thrown away and replaced with new instances in case of

## Patch

The patch requires upgrading wasmvm to 1.5.6, 2.0.5 or 2.1.4 and then apply this diff:<br/>
The patch requires upgrading wasmvm to 1.5.7, 2.0.5 or 2.1.4 and then apply this diff for Cosmos SDK 0.50 chains:<br/>
https://github.com/CosmWasm/wasmd/compare/80760aea336f0f1ad34756b0f03267d98cac6a04...v0.53.2
or this diff for chains using an older Cosmos SDK:<br/>
https://github.com/CosmWasm/wasmd/compare/96634f38903fa31e54f49a00018613cd9a29598e...v0.34.1

## Applying the patch

Expand All @@ -47,19 +51,19 @@ If you are instead using wasmvm 2.1.2, then upgrading to 2.1.4 includes the cons

### DIY Patch

If you are unable to upgrade to the latest version, you can backport the wasmd patch to your version. The patch is available at [Wasmd 0.53.2](https://github.com/CosmWasm/wasmd/compare/v0.53.0...v0.53.2).
However, if you are on an older version of wasmd, you will also be using a different version of wasmvm. We provide the required patches for wasmvm in versions 2.1.4, 2.0.5, 1.5.6.
If you are unable to upgrade to the latest version, you can backport the wasmd patch to your version. The patch is available at [Wasmd 0.53.2](https://github.com/CosmWasm/wasmd/compare/v0.53.0...v0.53.2) and at [Wasmd 0.34.1](https://github.com/CosmWasm/wasmd/compare/v0.34.0...v0.34.1).
However, if you are on a different version of wasmd, you will also be using a different version of wasmvm. We provide the required patches for wasmvm in versions 2.1.4, 2.0.5, 1.5.7.
To upgrade using this method:

1. Check the current wasmvm version: `go list -m github.com/CosmWasm/wasmvm` and upgrade
to the closest patched version.
2. Bump the github.com/CosmWasm/wasmvm dependency in your go.mod to the closest compatible patched version (either 2.1.4, 2.0.5 or 1.5.6); go mod tidy; commit.
2. Bump the github.com/CosmWasm/wasmvm dependency in your go.mod to the closest compatible patched version (either 2.1.4, 2.0.5 or 1.5.7); go mod tidy; commit.
3. Apply the patch linked above to your version of wasmd.
4. If you use the static libraries `libwasmvm_muslc.aarch64.a`/`libwasmvm_muslc.x86_64.a`, make sure that you use the same version as your wasmvm version.
5. Follow your regular practices to deploy chain upgrades.

To double check if the correct library version is loaded at runtime, use this query:
`<appd> query wasm libwasmvm-version`. It must show 2.1.4, 2.0.5 or 1.5.6 and must be the same as the wasmvm version in your go.sum.
`<appd> query wasm libwasmvm-version`. It must show 2.1.4, 2.0.5 or 1.5.7 and must be the same as the wasmvm version in your go.sum.

The patch is not consensus breaking as long as you were using the previous patch version of wasmvm before.

Expand Down
Loading