NRDAX-T0409 - Blocked Address Validation Bypass
Pending classification · active · first seen 2026-07-19
Producer label: consensus_abuse. Not yet assigned a mechanism family.
provenance: Reproduced in NullRabbit's attack-reproduction pipeline
mechanism
ASA-2024-003 / GHSA-4j93-fm92-rp4m (cosmos-sdk cosmos-sdk <= v0.50.3 / <= v0.47.8): x/auth/vesting MsgCreateVestingAccount / MsgCreatePermanentLockedAccount did not reject a blocked `to_address` (a module account on the bank blocklist), so one permissionless signed tx could create a vesting account at an uninitialised blocked module address; a later GetModuleAccount on it panics -> chain halt (CWE-20). Confirmed live: the signed tx reaches DeliverTx on patched gaiad v21 and is rejected with '<addr> is not allowed to receive funds: unauthorized' (the fix's guard); on a vulnerable node it halts the chain. Fixed v0.50.4 / v0.47.9. https://github.com/advisories/GHSA-4j93-fm92-rp4m
live exposure
No exposure data. Slashr ↗ has no risk signal mapped to this technique yet — absence of data is not absence of exposure.
instances (1)
| chain | primitive | fidelity | origin | reproducer (bundle) | source |
|---|---|---|---|---|---|
| cosmos | cosmos_vesting_blocked_address | lab | reverse-engineered-cve | cosmos_vesting_blocked_address | GHSA-4j93-fm92-rp4m ↗ |
cite
https://nrdax.com/techniques/NRDAX-T0409
NRDAX Registry. Technique NRDAX-T0409.
@misc{nrdax_NRDAX_T0409,
title = {Blocked Address Validation Bypass (NRDAX-T0409)},
howpublished = {NRDAX Registry},
url = {https://nrdax.com/techniques/NRDAX-T0409},
} {
"id": "nrdax-NRDAX-T0409",
"type": "dataset",
"title": "Blocked Address Validation Bypass (NRDAX-T0409)",
"URL": "https://nrdax.com/techniques/NRDAX-T0409",
"publisher": "NRDAX Registry"
} 
[](https://nrdax.com/techniques/NRDAX-T0409-blocked-address-validation-bypass)
use from the CLI
Retrieve or cite this technique from a script or the terminal with the NRDAX Python library & CLI.
nrdax get NRDAX-T0409nrdax cite NRDAX-T0409 --format bibtex